Subject: [clue] Finishing up Security Considerations for protocol

From: Paul Kyzivat <[email-masked]>
Date: Tue, 19 Apr 2016 14:07:37 -0400

The protocol needs to have a Security Considerations section before it 
can progress. That is the main gating item at this point.

This should be pretty simple. The following are my thoughts about what 
should be in it:

- it should reference the security considerations in the framework. They 
cover many important issues and those probably don't need to be restated 
as long as they are referenced.

- it should reference the security considerations in the data model. 
That document has most of the critical data to be concerned with.

- a reference to the security considerations in the clue-datachannel 
draft will cover the protection of the content of the protocol messages.

- There probably should be a brief discussion of the extra data in the 
protocol (not in the data model) that exposes information that might be 
of concern. I think this is primarily in the options negotiation: 
exposing all the versions and options supported could conceivably leak a 
bit of info about the specific software. In theory an implementation 
could choose not to announce all the versions it supports if it wants to 
avoid such leakage, though it would reduce interoperability. And of 
course it will only be relevant when there are multiple versions and 
options.

	Thanks,
	Paul