Subject: [ippm] IESG review of draft-ietf-ippm-owdp-reqs-04.txt

From: Allison Mankin <[email-masked]>
Date: Sat, 30 Nov 2002 22:39:59 -0800

Folks,

Apologies for some delay on this - the IESG security review was omitted
from the tracker.  Steve Bellovin wished for a revision of the owdp
requirements draft to better consider security of the timestamps.
Here is his comment:

  What are the effects on the measurement if an unencrypted (and,
  presumably, unauthenticated) timestamp is modified?  They seem to
  have a strong preference for leaving them in the clear.  It may not
  be a solvable problem, given their other constraints, but they should
  document the tradeoff.

  Still looks vulnerable to replays.  They mention the word "replay",
  but say nothing about what to do.  Timestamps are one traditional
  mechanism -- but not if they're unprotected...

  For the replay issue, what I'm asking for is a section analogous
  to 6.3, 6.4, etc., explaining the problem and giving the constraints
  on possible solutions (such as not using unprotected timestamps).

It is important to address Steve's point in a new draft and I will
call his attention to the fix.

In the draft tracker there is another review, from the Ops directorate
that (in my view) does not require any specific changes in
the revision if the chairs/group don't feel strongly about them.

  https://www.ietf.org/IESG/EVALUATIONS/draft-ietf-ippm-owdp-reqs.bal

Allison

P.S.  For those who've missed it, the draft tracker is at:

  https://datatracker.ietf.org/public/pidtracker.cgi

------- End of Forwarded Message

_______________________________________________
ippm mailing list
[email-masked]
http://mailhost.advanced.org/mailman/listinfo/ippm