Subject: RE: Back to terminology

From: Cuellar Jorge <[email-masked]>
Date: Wed, 20 Feb 2002 00:09:42 +0100

Hi Randall,

> >"the location recipient has to verify the authenticity of the
> >policies of the owner", this distinction becomes important.

> I'm not sure that we need to get involved in the policies themselves, 
> including how they are authenticated.  Maybe at a later stage, after 
> the initial work is done.  As long as our work allows policies to be 
> specified and enforced, in a way that meets our requirements for 
> security and privacy, I think that may be enough to start with.  In 
> fact, we must (per our charter) start with the requirements.

Yes, I agree: I'm not sure that we need to get involved in the 
policies themselves;  as long as our work allows policies to be 
specified and enforced...

But in order to enforce the policies the location server
does need to know that they are authentic, or not?

> >OK.  My distinction between the different types of Location Recipients
> >("private", "lawful" (= "regulatory") and "operational") is quite
premature.
> 
> I especially do not want to get into any awareness within our work of 
> legal or regulatory issues.  I think that can easily become a rat 
> hole.  This is one reason to avoid getting into policy details.

We agree on that.

> >At some point or other we will have to consider that not all types of
> >recipients will be subject to the same laws or policies
> 
> I'd like to avoid doing that.  If an operational entity is forced by 
> law or regulation or contract to impose constraints on the policies 
> of its users, that's their business.  As long as our work permits 
> this to occur, it needn't concern us.

We agree on that, for now. I think much later we could think about
other privacy requirements (for instance *notice*) that could apply to
operational or emergency location servers. But I agree: for
now, forget it.

> >certain properly authenticated "lawful
> >location recipients" are always authorized to get any location
information
> >they ask for.
> 
> This is a detail of a policy.  If we stay out of such matters, we 
> avoid a great deal of complexity.

We agree on that.

Jorge

---

From: Randall Gellens <[email-masked]>
Date: Tue, 19 Feb 2002 15:50:23 -0800

>does need to know that they are authentic, or not?

Yes, but it's not clear that this is a problem we have to deal with.

---

From: Adam Shostack <[email-masked]>
Date: Tue, 19 Feb 2002 18:55:09 -0500

> Yes, but it's not clear that this is a problem we have to deal with.

If a policy is not authentic, then we are exposed to either a possible
violation of someone's privacy preference or a denial of service.

I think that we need to "deal with the problem" by documenting a
requirement.

Adam

---

From: Randy Bush <[email-masked]>
Date: Tue, 19 Feb 2002 16:04:54 -0800

>> But in order to enforce the policies the location server does need to
>> know that they are authentic, or not?

as authentication and trust models are at the core of most aspects of
net security, they may be somewhat relevant.  i would think it nice to
know the policies i am applying are legitimate.

randy

---

From: Randall Gellens <[email-masked]>
Date: Tue, 19 Feb 2002 16:11:52 -0800

>I think that we need to "deal with the problem" by documenting a

I agree.

---

From: Randall Gellens <[email-masked]>
Date: Tue, 19 Feb 2002 16:14:28 -0800

>know the policies i am applying are legitimate.

I agree, if you mean that there exists a requirement that the policy 
be authentic.  But the mechanics of that are not for us to deal with, 
at least at this time.