Subject: Re: [Insipid] FW: New Version Notification for draft-jones-insipid-session-id-02.txt

From: Robert Sparks <[email-masked]>
Date: Fri, 01 Mar 2013 14:55:44 -0600

> - Added a comment in the Security Cons section that this spec (or the 
> Session-ID itself) MUST NOT be used for billing, but the authors 
> failed to capture from Atlanta why that is a problem. Any help here 
> (from someone that has any memories of why this was desired - speak up 
> please!)
I think you added this because of a question I asked, and this was very 
much not the result I had expected. I think you should revert it - it's 
not a protocol requirement. At best, you could say that supporting 
billing systems is not a use case that is being considered in the design 
of a mechanism meeting these requirements. (If anybody disagrees with 
that, speak up).

The point was to figure out whether or not a 3rd party being able to 
guess these identifiers was important.

The requirements document should be clear on here - is there a 
requirement for them to be hard to guess? Is it important for them to be 
hard to spoof? Is it important to protect them from eavesdropping?

There was a brief conversation in the meeting about whether or not 
someone would be able to use knowledge of these things (either from 
guessing them, or eavesdropping on them) to do something "bad". Billing 
was pointed to as one attack surface for bad. It's not the only one. If 
these _ever_ get used for, e.g. admission policy (like Replaces does), 
then there are security considerations that need to be discussed.

RjS