Subject: [clue] Kathleen Moriarty's Discuss on draft-ietf-clue-data-model-schema-14: (with DISCUSS)

From: "Kathleen Moriarty" <[email-masked]>
Date: Tue, 31 May 2016 14:38:00 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-clue-data-model-schema-14: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-clue-data-model-schema/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

The document looks good, I just have a couple of items on the security
considerations to discuss as they are not mentioned and I'm not sure if
they have a good reason to be excluded.

1. Session encryption to prevent active (tampering) or passive
(information gathering for example) attacks.  Integrity protection and
authentication are mentioned, but without looking through a few
documents, I don't know if that means encryption or some hash value
comparisons or something else. 

2. Schema drafts tend to cover the need for well-formed schemas as part
of the security considerations.  Can you add something in about that (not
much is required, but it's good for implementers to know this is
important)?  You can see two recent examples for guidance:
YANG - https://datatracker.ietf.org/doc/draft-ietf-netmod-rfc6020bis/
IODEF - https://datatracker.ietf.org/doc/draft-ietf-mile-rfc5070-bis/