Subject: [Geopriv] Comments on security considerations in draft-ietf-geopriv-lbyr-requirements-01

From: Richard Barnes <[email-masked]>
Date: Thu, 06 Dec 2007 16:00:56 -0800

Part 3 in a three-part series.
1. Comments on introductory text
2. Comments on requirements
3. Comments on security considerations

I'm going to reverse myself here and say that this document should
explicitly discuss security requirements.  This is mainly because this
document needs to get done quickly (i.e., without waiting for
draft-barnes-geopriv-lo-sec), and because this document needs to be more
specific than that document.  (That said, I expect the concerns
discussed in lo-sec to be a superset of the concerns here.)

The high-level structure I have in mind is as follows:
-- Creating LbyR mechanisms makes endpoint location information
accessible to third parties.
-- The primary risk created by this is the disclosure of location
information to parties not authorized by the endpoint to receive it.
-- There are two methods for preventing this access
1. Access control at dereference requires client authentication and
authorization mechanisms
2. Pawn tickets require randomization and strong protection of the URI
itself.  In particular, the management protocol require authentication.
-- In either of these models, there is a risk that implementation
defects will allow the access control model to be circumvented.

I will provide text soon.

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv