[Drip] review of -arch-22

"Card, Stu" <stu.card@axenterprize.com> Tue, 22 March 2022 21:55 UTC

MIME-Version: 1.0
From: "Card, Stu" <stu.card@axenterprize.com>
Date: Tue, 22 Mar 2022 17:55:34 -0400
Message-ID: <CAKM0pYMsyiVHKG0a8JqEAPAH3LAHN4ikZNORkCym+xv+F10pfw@mail.gmail.com>
To: tm-rid@ietf.org
Content-Type: multipart/alternative; boundary="000000000000011b9005dad5add3"
Archived-At: <https://mailarchive.ietf.org/arch/msg/tm-rid/MkN0UTDdtfAWGbMwa99siP4uVoY>
Subject: [Drip] review of -arch-22
Precedence: list

While recent edits of -arch have improved it overall (thanks all!), they
have also introduced a few errors.

1.1 last paragraph "UAS RID discussed in Section 3" refers to the
identifier, so should appear as "UAS ID"; "UAS RID" refers to the need,
process and system, not the identifier.

4.2 "(more details in Section 9)" is no longer accurate as security
considerations have been reworded so specific vulnerabilities are stated
more generally and seem less dangerous.

9. "Thus an adversary could impersonate a validly registered UA. This
attack would only be exposed when the HI in DRIP authentication message is
checked back to the USS and found not to " is incorrect as this attack is
defeated by broadcasting registry attestations on UA etc. as described in
-auth, which unfortunately still lacks, in -arch, the introduction provided
therein for -rid (actually -dets) and -registries.

9. "Finally..." states one vulnerability, then 3 more unrelated to the
first.

Throughout, may/MAY/should/SHOULD/must/MUST need review, IMO they have been
excessively weakened.

[Drip] review of -arch-22 Card, Stu