Subject: [weirds] wglc review of draft-ietf-weirds-rdap-sec

From: Andy Newton <[email-masked]>
Date: Fri, 19 Sep 2014 18:48:17 +0000

I have reviewed draft-ietf-weirds-rdap-sec and have a couple of comments.
Overall, I think it looks great.

1. I assume the reference to RFC 2818 (which is Informational) is ok. We
may want to see if there is a more modern reference that has come out of
the HTTPbis working group. I don¹t really care, but this seems like one of
those nitpicky things the IESG will hit us with.

2. Section 3.1 talks about Basic and Digest authentication and says
servers MUST implement both. While I agree clients MUST implement both,
the servers part gives me a little heartburn. If we are trying to say
server implementations should implement both but server operators are free
to do as they please, I agree. Perhaps the following additional paragraph
to section 3 to tie authentication, authorization, and policy altogether:

  This section describes security authentication mechanisms and their need
for implementation by authorization policies. This section places
requirements upon the implementations of clients and servers but does not
dictate the policies of server operators. For example, a server operator
with no policy regarding differentiated or tiered access to data will have
no authorization mechanisms and will have no need for any type of
authentication. But a server operator with policies on differentiated
access will have to construct an authorization scheme and will need to
follow the requirements of authentication as specified below.

That might be to wordy, but you get the picture.

3. Section 3.2 has the sentence "Server operators SHOULD offer varying
degrees of access²Š I think that SHOULD really ought to be a MAY.

Thanks to the author team for putting this document together.

-andy

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 22 Sep 2014 12:36:47 +0000

> -----Original Message-----
> From: weirds [mailto:[email-masked]] On Behalf Of Andy Newton
> Sent: Friday, September 19, 2014 2:48 PM
> To: [email-masked]
> Subject: [weirds] wglc review of draft-ietf-weirds-rdap-sec
> 

RFC 7230 is a possibility (it describes the https URI scheme), but it also references 2818. I'd prefer to use 2818 because we're specifically talking about TLS protection and not the URI scheme.

> Thanks to the author team for putting this document together.

I'll take care of these. Thanks for the feedback!

Scott