Subject: [mile] Comments on rfc6045-bis-05

From: "Waltermire, David A." <[email-masked]>
Date: Wed, 11 Jan 2012 17:32:20 -0500

Kathleen, et al,

In reviewing this document I found a couple items that I wanted to bring to your attention.

1) In section 9.1 the statement "The IODEF/RID document may be encrypted to provide an extra layer of security between peers so that the message is not only encrypted for the transport, but also while stored" implies that messages will be stored as encrypted XML. This statement esentially requires that the signed XML be persisted using a method that will not corrupt the digest. Since this format is largely focused on exchange of messages it may be a step too far to state requirements for storage. My recommendation is to truncate the sentence to "The IODEF/RID document may be encrypted to provide an extra layer of security between peers."

2) In section 5.5 item 3, reads:

"Implementations SHOULD NOT download schemas at runtime due to the security implications, and included documents MUST NOT be required to provide a resolvable location of their schema."

This is a reasonable requirement, but it might make sense to move or duplicate this wording in a paragraph under section "10 Security Recommendations".

Sincerely,
David Waltermire

---

From: <[email-masked]>
Date: Wed, 11 Jan 2012 18:25:57 -0500

Thank you for the comments, Dave!

I agree and will update the document accordingly to fix the nits.

Thank you,
Kathleen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Waltermire, David A.
Sent: Wednesday, January 11, 2012 5:32 PM
To: [email-masked]
Subject: [mile] Comments on rfc6045-bis-05

Kathleen, et al,

Sincerely,
David Waltermire

_______________________________________________
mile mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/mile