Subject: Re: [Geopriv]WGLCondraft-ietf-geopriv-l7-lcp-ps-00(PIDF-LOdigitalsignatures)

From: Andrew Newton <[email-masked]>
Date: Wed, 7 Mar 2007 10:13:19 -0500

On Feb 28, 2007, at 9:03 PM, Dawson, Martin wrote:

> The assertion mechanism permits the device to submit its own  
> opinion of
> the location as part of the request. The LIS can apply the assertion
> test and, if it passes, this location is returned as the actual  
> result.
> If it fails, then the LIS returns its opinion of the location. This
> provides the simple function of permitting the device to test its own
> location determination against that provided by the network.  
> However, it
> becomes especially useful when used in conjunction with a signed
> location request. Then the result is a signed location either way -  
> and
> it will be the device determined location or the LIS determined  
> location
> depending on the result of the assertion test.

How does the assertion test work?  This seems like a big security hole.

-andy

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: "Dawson, Martin" <[email-masked]>
Date: Wed, 7 Mar 2007 15:47:29 -0600

The assertion test is a matter of local policy for the LIS - it
understands the constraints appropriate to the access network it
provides service for.

The premise was that a device can work out its own location and it can't
apply a signature for this result. This was supposed to mean that we
should just give up on the concept of location signatures altogether.
The LIS can apply its policy, where the requestor would like the
location underwritten with a signature, in deciding whether the
proffered location passes the assertion test. A more precise version of
location information, that is still going to be routed to the same
emergency call destination, be trusted enough to pass through any policy
filters, be handled by the operators in the same way, but which may be
more helpful than a location with a bigger area of uncertainty can be
deemed to be worthy of a signature.

The choice is to send the location without a signature and without
validation of any kind. This cannot be considered secure enough while at
the same time suggesting that obtaining an asserted location opens a big
security hole. And I don't buy into any arguments that the "implied
integrity" somehow makes things less secure. As long as the recipients
understand the nature of location information this is not an issue - and
it's certainly no more significant an issue than the fact that the
recipient may think the center of an area of uncertainty is somehow more
correct than every other point in that area of uncertainty.

Cheers,

Martin

________________________________

From: Andrew Newton [mailto:[email-masked]] 
Sent: Thursday, 8 March 2007 2:13 AM
To: Dawson, Martin
Cc: Marc Linsner; Brian Rosen; GEOPRIV
Subject: Re:
[Geopriv]WGLCondraft-ietf-geopriv-l7-lcp-ps-00(PIDF-LOdigitalsignatures)

The assertion mechanism permits the device to submit its own opinion of

test and, if it passes, this location is returned as the actual result.

location determination against that provided by the network. However, it

location request. Then the result is a signed location either way - and

it will be the device determined location or the LIS determined location

-andy

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]
_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv