Subject: Re: [Ace] Use Case draft

From: "Kepeng Li" <[email-masked]>
Date: Tue, 29 Jul 2014 20:39:42 +0800

Agree with Steffi.

Kind Regards
Kepeng

------------------ 原始邮件 ------------------
发件人: "Stefanie Gerdes" <[email-masked]>;
发送时间: 2014年7月29日(星期二) 20:16
收件人: "Ludwig Seitz" <[email-masked]>;"ace" <[email-masked]>;"Kathleen Moriarty" <[email-masked]>;
主题: Re: [Ace] Use Case draft

Hi Kathleen and Ludwig, 
 
On 07/29/2014 10:01 AM, Ludwig Seitz wrote: 
> On 07/28/2014 10:29 PM, Kathleen Moriarty wrote: 
>> 
>> 2. Logging, protection of logs (and purging) is mentioned in one of the 
>> use cases, but not in the security section.  This would be a good 
>> addition, but should also include privacy considerations associated with 
>> the logs as well (correlation of events, etc.). 
>  
> We had a discussion about Auditing (the third A of AAA) and logging 
> during the chartering process, and some people thought it would make the 
> focus of the group too broad to try and also cover Auditing (including 
> logging). 
>  
> Therefore I have left out questions of auditing (and privacy) for the 
> moment. 
 
I think privacy is interesting to consider. The reason for using 
authorization mechanisms is to protect data, i.e. to achieve certain 
security objectives such as integrity and confidentiality. Privacy is 
interesting to consider as it stresses the need for confidentiality. 
 
Thanks 
Steffi 
 
_______________________________________________ 
Ace mailing list 
[email-masked] 
https://www.ietf.org/mailman/listinfo/ace

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 29 Jul 2014 09:22:14 -0400

On Tue, Jul 29, 2014 at 8:39 AM, Kepeng Li <[email-masked]> wrote:

> *发件人:* "Stefanie Gerdes" <[email-masked]>;
> *发送时间:* 2014年7月29日(星期二) 20:16
> *收件人:* "Ludwig Seitz" <[email-masked]>;"ace" <[email-masked]>;"Kathleen
> Moriarty" <[email-masked]>;
> *主题:* Re: [Ace] Use Case draft
>
>
> Hi Kathleen and Ludwig,
>
> Yes and without covering this, the considerations would be incomplete and
this would get caught in last call.  It's much easier to address it now.
 See RFC6973 for reference on current privacy considerations in IETF
protocols.

Thanks,
Kathleen

-- 

Best regards,
Kathleen