Subject: Re: #549: augmented security considerations in p1

From: "Roy T. Fielding" <[email-masked]>
Date: Sat, 1 Feb 2014 01:42:43 -0800

On Jan 31, 2014, at 8:36 PM, Mark Nottingham wrote:

>>  The "https" scheme (Section 2.7.2) is intended to prevent (or at
>>  least reveal) many of these potential attacks on establishing
>>  authority, assuming the negotiated TLS connection is secured in a way
>>  that verifies the communicating server's identity matches the target
>>  URI's authority component (see [RFC2818] and [Georgiev]).
> 
> Given the state of the world, this seems like a huge assumption — can we at least acknowledge that here be dragons as well?

Yep, the paper by Georgiev et al. is a catalog of dragons with real
examples and suggestions.  I will split that into two sentences so
that the reason to look at the paper is clear.

....Roy

---

From: "Roy T. Fielding" <[email-masked]>
Date: Sat, 1 Feb 2014 03:24:45 -0800

On Jan 31, 2014, at 5:24 AM, Michael Sweet wrote:

> My only comment is that here and in 2.7.2 we are referencing RFC 2818, but that reference is informative.
> 
> Shouldn't we be normatively referencing RFC 2818 since we are only updating it and not obsoleting it?

I don't believe so -- the reference is informative because we don't
depend on it for any of our syntax or requirements.  When someone
gets around to updating 2818, that spec will have a normative
reference on this set since it requires https and HTTP.

....Roy

---

From: Julian Reschke <[email-masked]>
Date: Sun, 02 Feb 2014 18:04:18 +0100

> that the reason to look at the paper is clear.

Hi Roy,

I have re-read all of the Security Considerations and they look good to 
me. Thank you for doing this work!

Best regards, Julian