Subject: [Geopriv] draft-ietf-geopriv-dhcp-civil-07

From: "Marc Linsner" <[email-masked]>
Date: Wed, 14 Sep 2005 10:52:12 -0400

Henning,

Wrt:

"This document only defines the delivery of location information from the
DHCP server to the client, due to security concerns related to using DHCP to
update the database.  Within the GEOPRIV architecture as defined by RFC 3693
[10], the defined mechanism in this document for conveying initial location
information is known as a "sighting" function.  Sighting functions are not
required to have security capabilities and are only intended to be
configured in trusted and controlled environments.  (A classic example of
the sighting function is a Global Positioning System wired directly to a
network node.) After initial location information has been introduced, it
MUST be afforded the protections defined in RFC 3694 [11].  Therefore,
location information MUST NOT be sent from a DHCP client to a DHCP server as
is normally allowed by DHCP."

Correct me if I've interpreted this wrong.  I derived from this text (at
least) 3 issues:

1) Due to [wiremap] database security concerns, we must disallow client to
dhcp server [upstream] communication of this LCI.

2) This DHCP LCI mechanism falls under the 'sighting' category as defined in
the geopriv architecture used in trusted and controlled environments.

3) Communication of location information outside of this special 'sighting'
category must be afforded the protections defined in RFC 3694.

I'd like clarification on:

1) Since neither this document nor RFC 3825 defines the wiremap database
architecture, I don't understand this db security concern.  How can the
transport of a db record be a security risk to the effecting of database
change within the unknown database architecture?  Is this not a concern for
the database administration?  We should not disallow this function solely
based on the assumption of poor database administration design.

2) Since upstream communication of this LCI information would still take
place within the confines of the 'sighting' category, a trusted and
controlled environment, what has happened that has made this upstream
communication fall under issue #3 (above)?  This LCI option can only contain
information allowed by the draft, whether it's upstream or downstream.

Thanks,

-Marc-

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Henning Schulzrinne <[email-masked]>
Date: Wed, 14 Sep 2005 16:51:01 -0400

Marc,

I'm just the "transmitter" in this case. The text was provided to me as 
part of resolving the IESG comments. Maybe those more closely involved 
with its drafting can provide additional input on your concerns.

Henning