Subject: [weirds] Summary of IESG DISCUSS Comments for rdap-sec (and proposed changes)

From: "Hollenbeck, Scott" <[email-masked]>
Date: Fri, 16 Aug 2013 17:08:40 +0000

All of the ballot comments can be seen here:

https://datatracker.ietf.org/doc/draft-ietf-weirds-rdap-sec/ballot/343468/

I'm also making minor changes to address the non-blocking comments. Here's a summary of the DISCUSS comments received from the IESG along with proposed text changes.

>From Richard Barnes:

> (1) The Authentication section should be Client Authentication, since
> that's all it covers.  Shouldn't there be some discussion of Server
> Authentication as well?

My response: "Thanks for the feedback, Richard. The section title is correct. The intention is to describe RDAP application of authentication security services for both clients and servers, so yes, I should add text to address server authentication. I don't think much is needed since we have no unique server authentication requirements beyond what we get with TLS. How about this?"

Add to section 3.1:

RDAP does not impose any unique server authentication requirements. The server authentication provided by TLS fully addresses the needs of RDAP. In general, transports for RDAP must either provide a TLS-protected transport (e.g., HTTPS) or a mechanism that provides an equivalent level of server authentication.

> (2) I don't see anything here or in draft-ietf-weirds-using-http that
> says that RDAP clients MUST support TLS.  Shouldn't that be the case,
> since HTTPS is the standard security mechanism?  You should probably
> also
> consider how this would impact requirements around URIs for RDAP
> services.

My response: I'm going to suggest that such text should be added to using-http since that document addresses how clients and servers use HTTP to exchange information. An appropriate reference to HTTP Over TLS and/or rdap-sec can be added to using-http.

>From Sean Turner:

> s3.1 contains the following:
> 
>  To that end, RDAP clients and
>    servers MUST implement the authentication framework specified in
>    "HTTP Authentication: Basic and Digest Access Authentication"
>    [RFC2617].
> 
> Does that mean the client and server need to support both basic and
> digest?

My response: Thanks for the feedback, Sean. A server needs to support one or the other. A client must be prepared to support both.

Add to section 3.1:

Servers MUST support either Basic or Digest authentication; they are not required to support both.  Clients MUST support both to interoperate with servers that support one or the other.

> s3.1: I think the gist here that should maybe be made clearer is that
> servers need MUST implement TLS with server side certificates - no?

My response: If there is a need to protect plaintext credentials they MUST.

> What
> I'm curious about here is whether there should be a SRV-ID or URI-ID is
> needed for RDAP and isn't some kind of reference to RFC 6125 warranted
> here?

My response: I'm open to suggestions. Whatever is appropriate for a web server would be appropriate for RDAP.

(I have not received a reply from Sean on this last point.)

Scott