Subject: [mile] GRC draft comments

From: Chris Inacio <[email-masked]>
Date: Wed, 13 Mar 2013 14:41:11 +0000

Here are some comments on the GRC draft.  I started skimming more around section 7 or so to the ends, so there isn't anything too detailed there.  But I'm not sure I would have detailed comments there anyway, at this point.

Why would / should the transport look into the GRC report XML to determine
its type to change the transport behavior.  This seems really, wrong.  Maybe
an application establishing transport would do that, but I don't think that
should be described as "transport". (Bottom of page 10, GRCPolicy class.)
(You can read this as: clarify what you mean by transport, because the
current use of transport isn't particularly clear.  Something like RID
or a similar alternative, which then has another transport (e.g. TCP, 
HTTP/TLS, etc.) needs to be clear.)

ReportID shouldn't have a default of the date.  That is a form of
information leakage.  I think that could be a MAY, with an acknowledgement
of the information leakage.  RANDOM would be a better default.  (An entity
could use some type of cryptographic algorithm that included date, but it
does leave the cryptographic channel somewhat exposed to attack via possible
known plain text.)

Should things like policy regions be registries?  Pro: it doesn't allow
strings to be created that have no common understanding of the meaning.
Con: can't validate the XML with information in a registry.  Should likely
apply to all MILE work.  This especially applies to MsgType of GRCPolicy
class.

What is the correct behavior of RID/"transport" for a GRCPolicy class with MsgType
ext-MsgType?

The GRCPolicy needs to be signed, or at least have the option.  Assume a
MITM attack that changes/adds the restriction setting, and makes the
document disclosable.  This MIGHT be otherwise protected by the transport,
but there is no promise of that.

Justifcation:  Do we need "other" and an extension mechanism too?  Neither
necessarily gives an implementor a lot of information about how to
act/behave.  I think 1 of these is enough.

ReportType: other & extension both included again.

GRCDocument: Version should be REQUIRED.

--
Chris Inacio
[email-masked]