Subject: [Gen-art] Gen-ART review of draft-ietf-weirds-rdap-sec-09

From: Christer Holmberg <[email-masked]>
Date: Sun, 19 Oct 2014 23:45:38 +0000

(Re-send with correct subject)

I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>

Document:                         draft-ietf-weirds-rdap-sec-09

Reviewer:                           Christer Holmberg

Review Date:                     19 October 2014

IETF LC End Date:             24 October 2014

IETF Telechat Date:         30 October 2014

Summary:                         I have found a number of issues. They are of editorial nature, but makes it difficult to understand the mechanism. I ask the authors to look at those, and consider if/how they can be addressed.

Major Issues: None

Minor Issues: None

Q1_GENERAL:

In the Introduction, you say that one of the goal of RDAP is to provide security services, that do not exist in WHOIS.

However, in section 3 you then say that RDAP doesn't provide any of these security services, but relies on other protocols.

First, I think you need to re-formulate the text in the Introduction, and talk about how other protocols can be used to provide security services for RDAP.

Second, there is no text on why "other protocols" couldn't be used to provide security services for WHOIS. I think you need to

say that, if you want to claim that RDAP provides better security than WHOIS.

Q2_GENERAL:

              In some places you say that additional/alternative mechanisms may be defined in the future. I think it would be good to in

the Introduction indicate that additional/alternative mechanisms can be added in the future.

Q3_GENERAL:

              You start some subsections by describing what WHOIS does/doesn't do. I think you should first describe of

the specific security service is provided for RDAP, and then later describe e.g. why the same cannot be provided

for WHOIS

Q4_3_1_1:

              Section 3.1.1. says: "Federated authentication mechanisms used by RDAP are OPTIONAL."

              That statement is confusing. Does it mean that everything else in the document is mandatory to support?

Q5_3_3:

              The name of section 3.3 is "Availability". I don't see how that is a security service, and the text mostly talks about

throttling. Would it be more appropriate to say "Request throttling" instead?

Q6_3_4:

              Section 3.4 says:

              "Web services such as RDAP commonly use HTTP Over TLS [RFC2818] to provide that protection by encrypting all

              traffic sent on the connection between client and server."

              To me that sounds like something from a BCP document. I think you should say that the document defines

the usage of HTTP over TLS for providing the security service.

Editorial nits: None

Regards,

Christer

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 20 Oct 2014 13:18:11 +0000

Thanks for the comments, Christer. More below.

Scott

From: Christer Holmberg [mailto:[email-masked]]
Sent: Sunday, October 19, 2014 7:46 PM
To: [email-masked]
Cc: [email-masked]
Subject: Gen-ART review of draft-ietf-weirds-rdap-sec-09

Major Issues: None

Minor Issues: None

Q1_GENERAL:

[SAH] The introduction currently states "This document describes how each of these services is achieved by RDAP". The details are described in later sections. I'm comfortable with changing "This document describes how each of these services is achieved by RDAP" to "This document describes how each of these services is achieved by RDAP using features that are available in other protocol layers", but I think it's more appropriate to leave the details where they are and not replicate them in the introduction.

[SAH] This document isn't focused on WHOIS deficiencies. The reference to RFC 3912 provides a pointer to WHOIS and its lack of security services.

Q2_GENERAL:

[SAH] OK, that's reasonable.

Q3_GENERAL:

for WHOIS

[SAH] Since this document isn't focused on WHOIS deficiencies I don't think this is necessary.

Q4_3_1_1:

[SAH] Good point. I can modify that sentence and the second sentence in that paragraph as follows:

"Federated authentication mechanisms MAY be used by RDAP. If used, they MUST be fully supported by HTTP."

Q5_3_3:

[SAH] The property of availability is described in Section 4 of RFC 4949. I believe the text is appropriate as-is.

Q6_3_4:

              Section 3.4 says:

[SAH] OK. I can change the sentence to "RDAP SHOULD use HTTP Over TLS [RFC2818] to provide that protection by encrypting all traffic sent on the connection between client and server". I'm sure there are people who will suggest that MUST is better than SHOULD, but that adds a requirement that hasn't been discussed in the WG. WG chairs - what do you think?

Editorial nits: None

Regards,

Christer

---

From: Christer Holmberg <[email-masked]>
Date: Tue, 21 Oct 2014 15:56:20 +0000

Hi Scott,

See inline.

Q1_GENERAL:

[Christer] Sure, you don't need to put the details in the introduction. The point is to make it clear that RDAP itself does not provide security services, and the text change you suggest look fine.

[Christer]

There is text saying:

"One goal of RDAP is to provide security services that do not exist in the WHOIS [RFC3912] protocol"

But, as RDAP doesn't provide security services, isn't that statement misleading? I think you should say that the security services that this document provides for RDAD do not exist for WHOIS.

Q2_GENERAL:

Q3_GENERAL:

for WHOIS

[Christer] My point was that you begin the sections by describing what WHOIS does/doesn't do, and that I think you should begin by describing the RDAP procedures.

So, I am not asking for more text, but simply to move some existing text around :)

Q4_3_1_1:

[Christer] Well, if you say "MAY use federated authentication", the questions whether the other mechanisms are mandatory still remain.

Perhaps you could simply say:

            "If federated authentication mechanism is used with RDAP, they MUST be fully supported by HTTP."

Q5_3_3:

[Christer] Ok.

Q6_3_4:

              Section 3.4 says:

[Christer] SHOULD normally means that it should also be described when it does not apply. However, your suggested text look fine, and I'll leave it up to you to decide whether to use SHOULD or MUST.

Regards,

Christer

---

From: Jari Arkko <[email-masked]>
Date: Thu, 30 Oct 2014 15:33:05 +0200

Christer:

Many thanks for your review. Much appreciated. 

Thank you Scott for addressing things that Christer brought up. I do agree with you though that detailed treatment of WHOIS is out of scope for this document. 

Jari

On 21 Oct 2014, at 18:56, Christer Holmberg <[email-masked]> wrote:

> However, in section 3 you then say that RDAP doesn’t provide any of these security services, but relies on other protocols.
>  
> [SAH] The introduction currently states “This document describes how each of these services is achieved by RDAP”. The details are described in later sections. I’m comfortable with changing “This document describes how each of these services is achieved by RDAP” to “This document describes how each of these services is achieved by RDAP using features that are available in other protocol layers”, but I think it’s more appropriate to leave the details where they are and not replicate them in the introduction.
>  
> [Christer] Sure, you don’t need to put the details in the introduction. The point is to make it clear that RDAP itself does not provide security services, and the text change you suggest look fine.
>  
> Second, there is no text on why “other protocols” couldn’t be used to provide security services for WHOIS. I think you need to
> [SAH] This document isn’t focused on WHOIS deficiencies. The reference to RFC 3912 provides a pointer to WHOIS and its lack of security services.
>  
> [Christer]
>  
> There is text saying:
>  
> “One goal of RDAP is to provide security services that do not exist in the WHOIS [RFC3912] protocol”
>  
> But, as RDAP doesn’t provide security services, isn’t that statement misleading? I think you should say that the security services that this document provides for RDAD do not exist for WHOIS.
>  
>  
> Q2_GENERAL:
>  
> [SAH] OK, that’s reasonable.
>  
> Q3_GENERAL:
>  
>               You start some subsections by describing what WHOIS does/doesn’t do. I think you should first describe of
> [SAH] Since this document isn’t focused on WHOIS deficiencies I don’t think this is necessary.
>  
> [Christer] My point was that you begin the sections by describing what WHOIS does/doesn’t do, and that I think you should begin by describing the RDAP procedures.
>  
>               Section 3.1.1. says: “Federated authentication mechanisms used by RDAP are OPTIONAL.”
>  
> “Federated authentication mechanisms MAY be used by RDAP. If used, they MUST be fully supported by HTTP.”
>  
> [Christer] Well, if you say “MAY use federated authentication”, the questions whether the other mechanisms are mandatory still remain.
>  
>             “If federated authentication mechanism is used with RDAP, they MUST be fully supported by HTTP.”
>  
> Q5_3_3:
>  
>               The name of section 3.3 is “Availability”. I don’t see how that is a security service, and the text mostly talks about
> throttling. Would it be more appropriate to say “Request throttling” instead?
>               “Web services such as RDAP commonly use HTTP Over TLS [RFC2818] to provide that protection by encrypting all
>               traffic sent on the connection between client and server.”
>  
> [SAH] OK. I can change the sentence to “RDAP SHOULD use HTTP Over TLS [RFC2818] to provide that protection by encrypting all traffic sent on the connection between client and server”. I’m sure there are people who will suggest that MUST is better than SHOULD, but that adds a requirement that hasn’t been discussed in the WG. WG chairs – what do you think?
>  
> [Christer] SHOULD normally means that it should also be described when it does not apply. However, your suggested text look fine, and I’ll leave it up to you to decide whether to use SHOULD or MUST.
>  
> Regards,
>  
> Christer
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art