Subject: [sacm] XMPP grid

From: Kathleen Moriarty <[email-masked]>
Date: Fri, 7 Nov 2014 08:40:11 -0500

Hello,

I just reviewed the recent version of XMPP grid:
https://tools.ietf.org/html/draft-salowey-sacm-xmpp-grid-01

First, thank you for your work on this draft.  It looks very good and I appreciate the detailed security considerations section.

Here are some comments to consider:

Figure 1 what does dev mean? I didn't see this expanded anywhere, maybe I missed it?

3.6 2nd bullet, typo NThe

6.3.1 set minimum for TLS - 1.2 unless there are reasons why that's not possible.

A reference to the UTA best practices draft for TLS would be good to add in this section.  It covers all the decisions admins need to consider (developers too).  It's close to finishing up, so it will be published before this draft.
http://tools.ietf.org/html/draft-ietf-uta-tls-bcp-05 

Http auth has a few newish options for authentication instead of just basic and digest, could one of them be an option?  HOBA is about to go into IETF last call.
6.2.1 - do you want to add a reference to the PM RFC7258?

7 privacy section
It's worth mentioning that the easiest way to protect privacy sensitive data is to leave it out in the first place.

You should add something to cover considerations for End to end crypto. This may matter more for any sensitive data that is sent via an alternate protocol like if-map.  I'm not as familiar with that protocol as it's been a while since I've read the spec.

For XMPP grid, I think from the flow diagrams, you actually wind up with point-to-point data access with no interchanges leveraging the grid until you switch to an end-to-end mechanism to transport the structured or unstructured data, is that correct?  I just want to make sure that is the case, if not, a recommendation for object-level encryption should be added for the control plane (common concern in the incident response space, which this could be used for as well and SACM has similar considerations for some of the data to be transported).

The draft looks great, thanks.

Thank you,
Kathleen

Sent from my iPhone

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Sat, 8 Nov 2014 12:28:01 +0000

Thanks for the review, Kathleen. 

Do the authors of this I-D plan to present the changes in the latest version at the Monday meeting? I would assume 'yes' but I did not receive any agenda request, and right now the protocols agenda item is TBD. 

Regards,

Dan

> -----Original Message-----
> From: sacm [mailto:[email-masked]] On Behalf Of Kathleen Moriarty
> Sent: Friday, November 07, 2014 3:40 PM
> To: [email-masked]
> Subject: [sacm] XMPP grid
> 
> Hello,
> 
> First, thank you for your work on this draft.  It looks very good and I
> appreciate the detailed security considerations section.
> 
> A reference to the UTA best practices draft for TLS would be good to add in
> this section.  It covers all the decisions admins need to consider (developers
> too).  It's close to finishing up, so it will be published before this draft.
> Http auth has a few newish options for authentication instead of just basic
> and digest, could one of them be an option?  HOBA is about to go into IETF
> last call.
> You should add something to cover considerations for End to end crypto. This
> may matter more for any sensitive data that is sent via an alternate protocol
> like if-map.  I'm not as familiar with that protocol as it's been a while since I've
> read the spec.
> 
> For XMPP grid, I think from the flow diagrams, you actually wind up with
> point-to-point data access with no interchanges leveraging the grid until you
> switch to an end-to-end mechanism to transport the structured or
> unstructured data, is that correct?  I just want to make sure that is the case, if
> not, a recommendation for object-level encryption should be added for the
> control plane (common concern in the incident response space, which this
> could be used for as well and SACM has similar considerations for some of
> the data to be transported).
> 
> _______________________________________________
> sacm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/sacm

---

From: "Nancy Cam-Winget (ncamwing)" <[email-masked]>
Date: Mon, 10 Nov 2014 07:12:22 +0000

Hi Dan,

Yes, we¹ll present, it is not a long presentation as not many updates were
madeŠ.
I do need to look at Kathleen¹s review comments and respondŠ.

	Nancy

On 11/8/14, 4:28 AM, "Romascanu, Dan (Dan)" <[email-masked]> wrote:

>Do the authors of this I-D plan to present the changes in the latest
>version at the Monday meeting? I would assume 'yes' but I did not receive
>any agenda request, and right now the protocols agenda item is TBD.
>
>Regards,
>
>Dan
>
>
>> Figure 1 what does dev mean? I didn't see this expanded anywhere, maybe
>>I
>> missed it?
>> 
>> It's worth mentioning that the easiest way to protect privacy sensitive
>>data is
>> to leave it out in the first place.
>>