Subject: Re: [clue] CLUE framework, security consideration section, level of mandation

From: Christian Groves <[email-masked]>
Date: Tue, 06 Jan 2015 10:55:24 +1100

Hello,

What it is the practical result of the second "must", i.e. "and the 
participants in the sessions MUST be made aware of this."?  Does this 
mean there's a legal disclaimer on the window saying that the 
participants may not be those you expect? Do we need the second part of 
the sentence pertaining to notification if we say that CLUE information 
MUST not be used for authorization?

Regards, Christian

On 29/12/2014 10:03 PM, Roni Even wrote:
>
> Hi,
>
> OK with this change
>
> Roni Even
>
> As individual
>
> *From:*clue [mailto:[email-masked]] *On Behalf Of *Stephan Wenger
> *Sent:* 29 December, 2014 4:52 AM
> *To:* CLUE
> *Subject:* [clue] CLUE framework, security consideration section, 
> level of mandation
>
> Hi,
>
> Mark and I are editing the framework document to address comments.
>
> This is with reference to my review, dated 12/16/2014, and 
> specifically point 9 therein, reproduced as follows:
>
> 9. Page 70, first paragraphs.  There are two unqualified “SHOULD” 
> statements.  In the spirit of fast doc approval, I wouldn’t object if 
> those were changed to “MUST”.  I don’t recall that we discussed these 
> points before, but I could easily have missed that discussion.
>
> Unless someone objects the two SHOULD statements will be replaced with 
> MUST.  The modified paragraph in markup is shown below (also 
> addressing comment 8 of my review, but that’s an editorial change and 
> should be uncontroversial).  Sorry for the messy formatting.
>
> I suggest a deadline of January 9, 2015, but do so without checking 
> with the chairs—who are of course free to set a different date if they 
> choose so.
>
> Regards,
>
> Stephan
>
>     A separate data channel is established to transport the CLUE
>     protocol messages. The contents of the CLUE protocol messages are
>     based on information introduced in this document, which is
>     represented by an XML schema for this information defined in the
>     CLUE data model [ref]._The CLUE data model [I-D.ietf-clue-data-model-schema] defines through an XML schema the syntax to be used._   Some of the information which could possibly introduce privacy concerns is the xCard information as described in section 7.1.1.11.  In addition, the (text)
>     description field in the Media Capture attribute (section 7.1.1.7)
>     could possibly reveal sensitive information or specific
>     identities. The same would be true for the descriptions in the
>     Capture Scene (section 7.3.1) and Capture Scene View (7.3.2)
>     attributes.   One other important consideration for the
>     information in the xCard as well as the description field in the
>     Media Capture and Capture Scene View attributes is that while the
>     endpoints involved in the session have been authenticated, there
>     is no assurance that the information in the xCard or description
>     fields is authentic.  Thus, this informationSHOULD  _MUST_  not be used to
>     make any authorization decisions and the participants in the
>     sessionsSHOULD  _MUST_  be made aware of this.
>
>
> _______________________________________________
> clue mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/clue

---

From: Stephan Wenger <[email-masked]>
Date: Tue, 6 Jan 2015 16:35:11 +0000

Hi Christian,
The only practical consequence I can envision is less noise during the
approval process from the security camp.  Of course, that¹s all I can
envision from ANY normative requirement in the security consideration
section--at least in my field of work, such requirements have been
regularly ignored by industry when convenient.
Being a bit less sarcastic, your logic seems to be correct, and the second
part of the sentence may therefore not be needed.  Although I vaguely
remember having seen a very similar formulation before in a different
context.  Mary, is this text from you?  Where did the formulation come
from?
Thanks,
Stephan

On 1/5/15, 15:55, "Christian Groves" <[email-masked]> wrote:

>> 9. Page 70, first paragraphs.  There are two unqualified ³SHOULD²
>> statements.  In the spirit of fast doc approval, I wouldn¹t object if
>> those were changed to ³MUST².  I don¹t recall that we discussed these
>> addressing comment 8 of my review, but that¹s an editorial change and
>> with the chairs‹who are of course free to set a different date if they
>> choose so.
>>
>> Regards,
>>
>> Stephan
>>
>>     CLUE data model [ref]._The CLUE data model
>>[I-D.ietf-clue-data-model-schema] defines through an XML schema the
>>syntax to be used._   Some of the information which could possibly
>>introduce privacy concerns is the xCard information as described in
>>section 7.1.1.11.  In addition, the (text)

---

From: "Duckworth, Mark" <[email-masked]>
Date: Thu, 8 Jan 2015 14:04:30 -0800

I agree with Christian.  So the proposal is to change the first SHOULD to MUST, and delete the last part of the sentence.  So the new text would be:

One other important consideration for the information in the xCard as well as the description field in the Media Capture and Capture Scene View attributes is that while the endpoints involved in the session have been authenticated, there is no assurance that the information in the xCard or description fields is authentic.  Thus, this information MUST NOT be used to make any authorization decisions.

Mark

> -----Original Message-----
> From: clue [mailto:[email-masked]] On Behalf Of Stephan Wenger
> Sent: Tuesday, January 06, 2015 11:35 AM
> To: Christian Groves; [email-masked]
> Subject: Re: [clue] CLUE framework, security consideration section, level of
> mandation
> 
> Hi Christian,
> >> with the chairs<who are of course free to set a different date if they
> >> choose so.
> >>
> >> Regards,
> >>
> >> Stephan
> >>

---

From: Christian Groves <[email-masked]>
Date: Fri, 09 Jan 2015 09:31:54 +1100

Hello Mark,

Sounds good.

Christian

---

From: Stephan Wenger <[email-masked]>
Date: Fri, 9 Jan 2015 01:28:51 +0000

Fine.
Stephan

On 1/8/15, 14:31, "Christian Groves" <[email-masked]> wrote:

>> I agree with Christian.  So the proposal is to change the first SHOULD
>>to MUST, and delete the last part of the sentence.  So the new text
>>would be:
>>
>> One other important consideration for the information in the xCard as
>>well as the description field in the Media Capture and Capture Scene
>>View attributes is that while the endpoints involved in the session have
>>been authenticated, there is no assurance that the information in the
>>xCard or description fields is authentic.  Thus, this information MUST
>>NOT be used to make any authorization decisions.
>>
>> Mark
>>
>>>>>      fields is authentic.  Thus, this informationSHOULD  _MUST_  not
>>>>>be
>>>>> used to

---

From: Paul Kyzivat <[email-masked]>
Date: Fri, 09 Jan 2015 12:26:50 -0500

+1

On 1/8/15 5:31 PM, Christian Groves wrote:
>> View attributes is that while the endpoints involved in the session
>> have been authenticated, there is no assurance that the information in
>> the xCard or description fields is authentic.  Thus, this information
>> MUST NOT be used to make any authorization decisions.
>>
>> Mark
>>
>>>>>      fields is authentic.  Thus, this informationSHOULD  _MUST_
>>>>> not be
>>>>> used to