Subject: Re: [weirds] review comments on draft-ietf-weirds-rdap-sec

From: Ning Kong <[email-masked]>
Date: Fri, 1 Mar 2013 18:16:29 +0800

Hi SM,

> I took a quick look at draft-ietf-weirds-rdap-sec-01.  Is it a protocol specification or a requirements document?
Our goal is to make a protocol spec although it maybe looks more like a requierments document now. 

> What is the meaning of "security services"?

Security services in this document means authentication, authorization, availability, and data confidentiality service for the RDAP. You could find a description of each of these security services in RFC 4949.

Cheers,
Ning

---

From: SM <[email-masked]>
Date: Fri, 01 Mar 2013 02:44:13 -0800

Hi Ning,
>like a requierments document now.

Ok.

>Security services in this document means authentication, 
>authorization, availability, and data confidentiality service for 
>the RDAP. You could find a description of each of these security 
>services in RFC 4949.

As I mentioned previously security is not an add-on service.  It 
would be better to look at the matter in terms of security properties 
provided by a protocol especially if the goal is to end up with a 
protocol specification.

Regards,
-sm

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 1 Mar 2013 12:23:36 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Ning Kong
> Sent: Thursday, February 28, 2013 10:43 PM
> To: Marc Blanchet
> Cc: [email-masked]; [email-masked]
> Subject: Re: [weirds] review comments on draft-ietf-weirds-rdap-sec
> 
> Hi Marc and Jean-Philippe,
> 
> Thanks for your review. Below are my feedbacks.
> 
> 3.1.  Authentication
> > <MB>There is an IETF thread going on to update/obsolete these basic
> schemes (see httpauth working group charter).  Therefore, it should be
> prudent to instead align with that.
> > </MB>
> 
> I agree that we should follow the relative outputs of this proposed WG.

I agree with this in principle, but only if adding a normative dependency does not slow us down in any way. The current references are stable, implemented, widely deployed, and already noted in Appendix A of draft-ietf-httpbis-authscheme-registrations. The current normative references are included in this appendix. What, exactly, would need to change?

Scott

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 1 Mar 2013 12:30:46 +0000

> Behalf Of SM
> Sent: Friday, March 01, 2013 1:19 AM
> To: Ning Kong
> I took a quick look at draft-ietf-weirds-rdap-sec-01.  Is it a protocol
> specification or a requirements document?

This is spelled out in both the abstract and the introduction. It is neither, exclusively, but it does include requirements. If you're trying to frame the context in more familiar terms it could be considered an external security considerations section that is applicable to multiple WEIRDS specifications.

> What is the meaning of "security services"?

The meaning is intended to be the same one described and used in RFC 4949. I'm having a hard time trying to break it down into simpler terms that mean the same thing as "services that provide elements of information security".

Scott