Subject: RE: [Ecrit] NENA Comments on draft-ietf-ecrit-requirements-00 -Security and Reliability

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Thu, 20 Oct 2005 15:48:03 -0400

I believe it will so long as the particular mapping information is
spelled out.
You are referring to location to PSAP URI mapping?
 
Mike

________________________________

	From: Brian Rosen [mailto:[email-masked]] 
	Sent: Thursday, October 20, 2005 3:39 PM
	To: Michael Hammer (mhammer); [email-masked]
	Subject: RE: [Ecrit] NENA Comments on
draft-ietf-ecrit-requirements-00 -Security and Reliability

	In this context, we are talking about the mapping information.
Using mapping information would distinguish our issue from your concern,
would it not?

	Brian

________________________________

	From: Michael Hammer (mhammer) [mailto:[email-masked]] 
	Sent: Thursday, October 20, 2005 3:28 PM
	To: [email-masked]; [email-masked]
	Subject: RE: [Ecrit] NENA Comments on
draft-ietf-ecrit-requirements-00 -Security and Reliability

	Brian,

	Routing information is rather broad and could be interpreted to
mean an SP can not manage its own proxy routing capabilities.  Could you
make this more specific to what you had in mind.

	Mike

________________________________

		From: [email-masked]
[mailto:[email-masked]] On Behalf Of Brian Rosen
		Sent: Thursday, October 20, 2005 11:16 AM
		To: [email-masked]
		Subject: [Ecrit] NENA Comments on
draft-ietf-ecrit-requirements-00 -Security and Reliability

		More <delayed> comments from NENA: 

		Our requirement 3.6-16: Information and mechanisms used
to determine routing must be extremely reliable and available, which
implies redundancy, protocol stability, and resiliency is not adequately
addressed by I8.  Resilience against server failure: A client MUST be
able to fail over to another replica of the mapping server, so that a
failure of a server does not endanger the ability to perform the
mapping.  We also don't think this adequately addresses 3.8-1: There
shall be no single point of failure or 3.8-3: Special consideration
should be given to distributed Denial of Service of Service attacks.  We
recognize this is part of the security issues being covered in another
document.

		We do not find something that covers our requirement
3.6-17: Routing information must be secured against unauthorized
modification.  PSAPs (or perhaps a higher level civic authority such as
a county, state/province or national body) or their designated
representative must be the only entities permitted to change routing
information.

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit

---

From: "Brian Rosen" <[email-masked]>
Date: Thu, 20 Oct 2005 16:10:45 -0400

yes

  _____  

From: Michael Hammer (mhammer) [mailto:[email-masked]] 
Sent: Thursday, October 20, 2005 3:48 PM
To: [email-masked]; [email-masked]
Subject: RE: [Ecrit] NENA Comments on draft-ietf-ecrit-requirements-00
-Security and Reliability

I believe it will so long as the particular mapping information is spelled
out.

Mike

  _____  

From: Brian Rosen [mailto:[email-masked]] 
Sent: Thursday, October 20, 2005 3:39 PM
To: Michael Hammer (mhammer); [email-masked]
Subject: RE: [Ecrit] NENA Comments on draft-ietf-ecrit-requirements-00
-Security and Reliability

In this context, we are talking about the mapping information.  Using
mapping information would distinguish our issue from your concern, would it
not?

Brian

  _____  

From: Michael Hammer (mhammer) [mailto:[email-masked]] 
Sent: Thursday, October 20, 2005 3:28 PM
To: [email-masked]; [email-masked]
Subject: RE: [Ecrit] NENA Comments on draft-ietf-ecrit-requirements-00
-Security and Reliability

Brian,

Routing information is rather broad and could be interpreted to mean an SP
can not manage its own proxy routing capabilities.  Could you make this more
specific to what you had in mind.

Mike

  _____  

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Brian Rosen
Sent: Thursday, October 20, 2005 11:16 AM
To: [email-masked]
Subject: [Ecrit] NENA Comments on draft-ietf-ecrit-requirements-00 -Security
and Reliability

Our requirement 3.6-16: Information and mechanisms used to determine routing
must be extremely reliable and available, which implies redundancy, protocol
stability, and resiliency is not adequately addressed by I8.  Resilience
against server failure: A client MUST be able to fail over to another
replica of the mapping server, so that a failure of a server does not
endanger the ability to perform the mapping.  We also don't think this
adequately addresses 3.8-1: There shall be no single point of failure or
3.8-3: Special consideration should be given to distributed Denial of
Service of Service attacks.  We recognize this is part of the security
issues being covered in another document.

We do not find something that covers our requirement 3.6-17: Routing
information must be secured against unauthorized modification.  PSAPs (or
perhaps a higher level civic authority such as a county, state/province or
national body) or their designated representative must be the only entities
permitted to change routing information.