Subject: [Geopriv] Changes in -policy-uri-06

From: Richard Barnes <[email-masked]>
Date: Wed, 26 Sep 2012 14:59:38 +0200

Dear GEOPRIV, 

The latest version of -policy-uri seems to have addressed all of the DISCUSS comments, but it contains several changes that I would like to run by the working group.  Going in order of the diff [1]:

-- Section 1: Clarified that LbyR only provides privacy protections if appropriate access control policies are configured

-- Section 3.1: Added requirement that clients SHOULD support HTTP client auth and MAY support TLS client certs.

-- Added Section 3.3, providing some example policies (e.g., a deny-all policy)

-- Section 7.1: Clarified that the general requirements for TLS support/usage are the same as for -deref-protocol.

-- Section 7.2: Clarified requirements for entropy in policy URIs, and provided an example algorithm for generating policy URIs

-- Added Section 7.4, recommending that policy URIs be protected to the same level as other shared secrets (e.g., passwords)

The only normative changes are (1) SHOULD support HTTP client auth, and (2) SHOULD protect policy URIs as shared secrets.

Hope this helps,
--Richard

[1] <http://tools.ietf.org/rfcdiff?url1=draft-ietf-geopriv-policy-uri-04.txt&url2=draft-ietf-geopriv-policy-uri-06.txt>

---

From: Alissa Cooper <[email-masked]>
Date: Thu, 27 Sep 2012 15:29:50 -0400

If anyone has comments on these changes, please send them to the list by Wednesday, October 3. 

On Sep 26, 2012, at 8:59 AM, Richard Barnes wrote:

> _______________________________________________
> Geopriv mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/geopriv