Subject: [Rift] Kathleen Moriarty's Block on charter-ietf-rift-00-05: (with BLOCK)

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 07 Feb 2018 06:58:41 -0800

Kathleen Moriarty has entered the following ballot position for
charter-ietf-rift-00-05: Block

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-rift/

----------------------------------------------------------------------
BLOCK:
----------------------------------------------------------------------

I appreciate the work on a threat analysis, I'd like to see something in the
charter that includes security mitigations in the protocol resulting from the
threat analysis work.  Can you adjust the text to include this?

Perhaps something like:

OLD:
 - A Standards Track specification that will include:
   - an Implementation Status section as described in RFC 7942
   - an Operational Considerations section to explain how the protocol is
   configured, deployed, and diagnosed - Security and Privacy Considerations,
   although this material may refer to a separate Threat Analysis document
   (q.v.)

 - A YANG module focused on configuration and monitoring of protocol instances

 - An Applicability Statement that describes how to deploy and configure the
 protocol in networks with different topologies

 - A Security Threat Analysis document that describes the attack vectors and
 mitigations that shall be sent for publication at the same time as the
 protocol specification

NEW:
 - A Standards Track specification that will include:
   - an Implementation Status section as described in RFC 7942
   - an Operational Considerations section to explain how the protocol is
   configured, deployed, and diagnosed, security and privacy mitigations
   for the protocol as identified in the threat analysis document.

 - A YANG module focused on configuration and monitoring of protocol instances

 - An Applicability Statement that describes how to deploy and configure the
 protocol in networks with different topologies

 - A Security Threat Analysis document that describes the attack vectors and
 mitigations that shall be sent for publication at the same time as the
 protocol specification

---

From: Alvaro Retana <[email-masked]>
Date: Wed, 7 Feb 2018 10:04:30 -0800

On February 7, 2018 at 9:58:42 AM, Kathleen Moriarty (
[email-masked]) wrote:

Kathleen:

Hi!

charter that includes security mitigations in the protocol resulting from
the
threat analysis work. Can you adjust the text to include this?

Yes…but the description of the Threat Analysis document already talks about
mitigations.  The intent of publishing at the same time [*] is precisely to
have both problems and solutions.

We can add your modified text if it makes it clearer — I think the current
text already covers it.

Thanks!

Alvaro.

[*] Or even just including the analysis and mitigations in the same spec,
depending on how the work goes

Perhaps something like:

OLD:

- A YANG module focused on configuration and monitoring of protocol
instances

NEW:

- A YANG module focused on configuration and monitoring of protocol
instances

---

From: Kathleen Moriarty <[email-masked]>
Date: Thu, 8 Feb 2018 10:18:54 -0500

On Wed, Feb 7, 2018 at 1:04 PM, Alvaro Retana <[email-masked]> wrote:
> On February 7, 2018 at 9:58:42 AM, Kathleen Moriarty
> ([email-masked]) wrote:
>
> Kathleen:
>
> Hi!
>

I think it would be better to have the mitigations in the protocol
document so they get implemented and can refer back to the threat
model.

Thank you,
Kathleen

-- 

Best regards,
Kathleen

---

From: Alvaro Retana <[email-masked]>
Date: Thu, 8 Feb 2018 11:29:29 -0800

On February 8, 2018 at 10:19:35 AM, Kathleen Moriarty (
[email-masked]) wrote:

Hi!

I’ve made the changes.  Please take a look.

Thanks!

Alvaro.