Re: [weirds] Alissa Cooper's Discuss on draft-ietf-weirds-rdap-sec-10: (with DISCUSS and COMMENT)

Top posting...

Alissa, draft-ietf-weirds-rdap-sec was updated on 2 December to address the comments described below. Could you please take another look and update your discuss position if the new version addresses your feedback appropriately?

Scott

> -----Original Message-----
> From: weirds [mailto:weirds-bounces@ietf.org] On Behalf Of Hollenbeck,
> Scott
> Sent: Tuesday, December 02, 2014 1:00 PM
> To: Alissa Cooper; IESG
> Cc: draft-ietf-weirds-rdap-sec@tools.ietf.org; weirds-
> chairs@tools.ietf.org; weirds@ietf.org
> Subject: Re: [weirds] Alissa Cooper's Discuss on draft-ietf-weirds-
> rdap-sec-10: (with DISCUSS and COMMENT)
> 
> > -----Original Message-----
> > From: Alissa Cooper [mailto:alissa@cooperw.in]
> > Sent: Tuesday, December 02, 2014 12:54 PM
> > To: IESG
> > Cc: draft-ietf-weirds-rdap-sec@tools.ietf.org; weirds-
> > chairs@tools.ietf.org; weirds@ietf.org
> > Subject: Re: Alissa Cooper's Discuss on draft-ietf-weirds-rdap-sec-
> 10:
> > (with DISCUSS and COMMENT)
> >
> > Thanks for addressing my DISCUSS points. I just have a couple of
> > follow-ups.
> >
> > I'm glad to see this new text in 3.5:
> >
> >    HTTP Over TLS MUST be used to
> >    protect all client-server exchanges unless operational constraints
> >    make it impossible to meet this requirement.
> >
> > Is it implied that this applies to rdap-bootstrap as well?
> 
> Yes. The bootstrap document currently says this:
> 
> "The transport used to access the registries could be more secure by
> using TLS [RFC5246] if IANA supports it."
> 
> So if IANA supports it TLS MUST  be used.
> 
> > Couple of comments on this text in section 5:
> >
> >    In addition to privacy risks to registrants, there are also
> > potential
> >    privacy risks for those who query registration data.  For example,
> >    the fact that a law enforcement officer performs a particular
> query
> >    may reveal information about the officer's activities that he or
> she
> >    would have preferred to keep private.  RDAP supports the use of
> HTTP
> >    over TLS to provide privacy protection for those querying
> registrant
> >    data as well as registrants.
> >
> > Someone in Honolulu suggested to me that the law enforcement officer
> > example might not be the best one, and that's probably right. I would
> > suggest substituting another term instead - maybe "registry
> employee"?
> >
> > I would also suggest editing the last sentence to match the above
> text
> > from 3.5: "RDAP requires the use of HTTP over TLS to provide privacy
> > protection for those querying registrant data as well as registrants,
> > unless operational constraints make it impossible to meet this
> > requirement."
> >
> > Also given the new text in 3.5, it seems like the recommendations in
> > section 6 regarding the TLS null cipher suite should be updated as
> > well. I would suggest "This option MUST NOT be used" - assuming the
> > same operational constraints caveat does not apply here.
> 
> These are all reasonable suggestions. I'll do another edit.
> 
> I can't think of an operational reason to use the TLS null cipher...
> 
> Scott
> 
> _______________________________________________
> weirds mailing list
> weirds@ietf.org
> https://www.ietf.org/mailman/listinfo/weirds