Subject: Re: [Ace] some minor comments/suggestions on draft-ietf-ace-actors-03

From: Michael Richardson <[email-masked]>
Date: Mon, 04 Apr 2016 09:33:21 -0400

I'm just going to pull a couple of questions out of my comments from two
weeks ago, as I think that they merit discussion on the mailing list, and
maybe at the mic:

Michael Richardson <[email-masked]> wrote:
    > Thank you for including 2.2, architecture variants.
    > I wonder if it would be worth specific references here to Bananas for Munich?

    > I think it might also be worth this because in some flows of that use
    > case, RqP = RO, and sometimes not, and these two situations occur in the
    > same system.  I'm concerned that someone might read 2.2 and think that
    > they have to pick *one* of those variants, instead of realizing that
    > they have to support all roles in some place in their system.

    > I think that 2.3 makes this pretty clear, but maybe the first paragraph
    > of 2.3 could be more authoritative?  i.e. we standarized flows and messages,
    > not devices :-)

...

QUESTION:
    > Yes. I wonder if there is a difference between *provisioning* and
    > *commissioning*, or if these just two words for the same thing, and if so, if
    > we (the IETF) should pick one?

...

    > Section 7.2: can we link the "in other use cases"
    > to the actual use cases in 7744?

    > Section 9.1: issue should be: 0, steal the device.
    > probably the most important concern is the ability to
    > rapidly de-authorize a device, and further, to be able to
    > determine if "this is the droid you are looking for"

...

    > 9.2: I suggest that instead of listing might, might, etc.
    > that we list in *security considerations* the specific attacks
    > that are excluded by various kinds of access to clocks.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-