Subject: Re: [Lurk] FW: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

From: "Mishra, Sanjay" <[email-masked]>
Date: Fri, 18 Mar 2016 11:30:37 -0400

Hi Daniel -- I have reviewed the draft-mglt-lurk-tls-use-cases-00.txt and at this time just wanted to share editorial feedback. Feel free to accept/reject as you see fit.

1.       Abstract (2nd sentence): replace "in order to set communications" --> "in order to set up secure communications"

2.       Introduction (3rd paragraph): remove duplicate "of" from  "This document providers use case where authentication of of"

3.       Terminology

a.       TLS Server, line 3: Change "my" -> "may"

b.      Edge Server, line 3: remove "be" from "but may be in fact served"

c.       CDN, line 1: Replace "a organization" with  "an organization"

d.      CDN, line 2: remove "a" from "delivery of a content"

4.       Cloud Use case

a.       2nd paragraph: "TLS provides end-to-end" -> "TLS provides an end-to-end"

b.      2nd paragraph, last sentence: Use of the word "differs" is not quite the right usage in the context of the sentence. Suggestion: "On the other hand, TLS can hardly be used in a secure, scalable way when the TLS server and the content server are not hosted on the same server".

c.       3rd paragraph, line 12: suggest re-arranging the sentence from  "cannot host the entirety of its content on a one single server" to "cannot host the content in its entirety on a single server"

d.      4th paragraph, first sentence, below is the suggested replacement text for the first sentence which otherwise is onerous to read:

                                                   i.      When the content provider host content on multiple servers spanning same subnet or across multiple subnet or when hosted on different networks, then in such cases, client authentication will occur over different TLS end points. In such cases, the TLS end points are designated as Edge Servers. These Edge Servers are used for connectivity...at the transport layer. (no changes to 2nd sentence)

e.      5th paragraph bullet  a)

                                                   i.      "Each Edge Server shares the authentication credential associated to the Content Provider." Suggest replacing "to" -> "with"

5.       Section 5

a.       2nd paragraph

                                                   i.      "as illustrated for example by the Heartbleed attack [HEART]." -> "as illustrated, for example, by the Heartbleed attack [HEART].

                                                 ii.      "Heartbleed attack uses a weakness of a software" -> "Heartbleed attack used a weakness of a software"

                                                iii.      "Such attack would not for example has been so successful" -> "Such an attack for example, would not have been so successful"

b.      3rd paragraph

                                                   i.      "At last, from a security point of view, this may be not acceptable the Content Provider ." -> "Lastly, from a security point of view, this may be not acceptable to the Content Provider ."

c.       4th paragraph

                                                   i.      "Currently an interface" -> Currently, an interface"

                                                 ii.      "such interface may be used within a CDN in order to manage its own Edge Servers." -> "such an interface may be used within a CDN to manage its own Edge Servers."

                                                iii.      "The absence of a standard interface and the lack of interoperability may also result in the Content Provider sharing the confidential information with a third party organization. This may be not acceptable in a security point of view." -> "The absence of a standard interface and the lack of interoperability (I assume you mean interoperability between CDNs?) may also result in the Content Provider (suggest to add something here such as "unwittingly" or unknowingly) sharing the confidential information with a third party organization. This may be not acceptable (call out not acceptable to whom?) from a security point of view."

6.       Section 6

a.       1st paragraph

                                                   i.      "split scenario is to avoid spreading authentication credentials of the Content Provider in multiple Edge Servers, and so to reduce the leak of such credentials." -> "split scenario is to avoid the need for sharing authentication credentials of the Content Provider with multiple Edge Servers, and therefore, reduce the risk of leaking out such credentials."

b.      2nd paragraph

                                                   i.      "necessarily prevent any leakage." -> "necessarily prevent leakage."

                                                 ii.      "More specifically, even though a Edge Server may become corrupted or under the control of an attacker, the attacker should not be able to be able to disclose the authentication credentials."  -> "More specifically, even though an Edge Server may become corrupted or get under the control of an attacker, the attacker should not be able to discover the authentication credentials."
Thanks
Sanjay

-----Original Message-----
From: Lurk [mailto:[email-masked]] On Behalf Of Daniel Migault
Sent: Tuesday, January 19, 2016 5:20 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Lurk] FW: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

Hi,

I am starting a new threat on the use cases. I would be glad to check the document describes the problem we want to solve.

Feel free to comment.

BR,
Daniel

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: Tuesday, January 19, 2016 4:40 PM
To: Kevin Ma J; Daniel Migault; Kevin Ma J
Subject: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

A new version of I-D, draft-mglt-lurk-tls-use-cases-00.txt
has been successfully submitted by Daniel Migault and posted to the IETF repository.

Name:                  draft-mglt-lurk-tls-use-cases
Revision:              00
Title:                      TLS/DTLS Content Provider Edge Server Split Use Case
Document date:               2016-01-19
Group:                  Individual Submission
Pages:                   7
URL:            https://www.ietf.org/internet-drafts/draft-mglt-lurk-tls-use-cases-00.txt
Status:         https://datatracker.ietf.org/doc/draft-mglt-lurk-tls-use-cases/
Htmlized:       https://tools.ietf.org/html/draft-mglt-lurk-tls-use-cases-00

Abstract:
   TLS as been designed to setup and authenticate transport layer
   between endpoints.

   A lot of applications are using TLS in order to set communications
   between the applications end points.

   As long as applications end points and transport end points were
   combined into the same host, application authentication could be
   combined with the transport authentication.

   As the current internet is decoupling the transport and application
  layers, such model may not be applicable anymore.  In other words,
   TLS authentication cannot be handled on behalf of the application
   authentication.

   This document describes use cases where the authentication of the
   transport layer differs from the authentication performed at the
   application layer.

Please note that it may take a couple of minutes from the time of submission until the htmlized version and diff are available at tools.ietf.org.

The IETF Secretariat

_______________________________________________
Lurk mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/lurk

---

From: Daniel Migault <[email-masked]>
Date: Fri, 18 Mar 2016 15:33:43 +0000

Thank you I appreciate the feed back!

BR,
Daniel

From: Mishra, Sanjay [mailto:[email-masked]]
Sent: Friday, March 18, 2016 12:31 PM
To: Daniel Migault
Cc: [email-masked]
Subject: RE: [Lurk] FW: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

3.       Terminology

4.       Cloud Use case

5.       Section 5

a.       2nd paragraph

b.      3rd paragraph

c.       4th paragraph

6.       Section 6

a.       1st paragraph

b.      2nd paragraph

-----Original Message-----
From: Lurk [mailto:[email-masked]] On Behalf Of Daniel Migault
Sent: Tuesday, January 19, 2016 5:20 PM
To: [email-masked]<mailto:[email-masked]>
Subject: [Lurk] FW: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

Hi,

Feel free to comment.

BR,
Daniel

-----Original Message-----
From: [email-masked]<mailto:[email-masked]> [mailto:[email-masked]]
Sent: Tuesday, January 19, 2016 4:40 PM
To: Kevin Ma J; Daniel Migault; Kevin Ma J
Subject: New Version Notification for draft-mglt-lurk-tls-use-cases-00.txt

Abstract:

The IETF Secretariat