Subject: [weirds] Comments on draft-ietf-weirds-rdap-sec-00

From: SM <[email-masked]>
Date: Thu, 27 Sep 2012 14:49:37 -0700

Hello,

These comments are on draft-ietf-weirds-rdap-sec-00.  Please note 
that this is not a review.

In the Introduction Section:

   "One goal of RDAP is to provide security services that do not exist
    in the WHOIS protocol"

One of the questions that may be asked is why is security not part of 
the protocol.

RFC 4949 is more of a glossary.  If I recall correctly, it has been 
used for some specification.  I am not sure whether it is a correct reference.

In Section 3.5:

   "TBD: does it make sense to talk about proof of integrity and data
    origin authentication for responses?"

I would say yes.  I suggest forgetting the law enforcement angle and 
look at this in terms of data integrity.  As a quick comment, I think 
that it may be easier to avoid non-repudiation.  It may be easier to 
focus on "securing" the protocol instead of looking at this from a 
data point of view.

Regards,
-sm