Subject: [weirds] AD Evaluation of draft-ietf-weirds-rdap-sec-03

From: Pete Resnick <[email-masked]>
Date: Wed, 29 May 2013 11:36:11 -0500

As with -using-http, please give the authors and/or Murray the chance to 
respond first:

Overall, I'm not clear on why this wasn't folded in to the -using-http 
document, more or less as the security considerations section, but I 
have no objection to keeping them separate.

Section 3.1:

    RDAP MUST include an authentication framework that can accommodate
    anonymous access as well as verification of identities using a range
    of authentication methods and credential services.

Specifying that a protocol MUST do something (as against an 
implementation or an actor in the protocol) is...weird. Don't you really 
mean, "RDAP's authentication framework needs to accomodate..."? There 
are no specific protocol/implementation requirements here.

Section 3.2:

    RDAP MUST include an authorization framework that is capable of
    providing granular (per registration data object) access controls
    according to the policies of the operator.

The same as in 3.1. I suggest, "An RDAP server MUST provide granular 
access controls (that is, on a per registration data object basis) in 
order to implement authorization policies."

RFCs 4732, 5280, and 6749 strike me as Informative, not Normative 
references.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 29 May 2013 18:09:38 +0000

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Pete Resnick
> Sent: Wednesday, May 29, 2013 12:36 PM
> To: [email-masked]
> Subject: [weirds] AD Evaluation of draft-ietf-weirds-rdap-sec-03
> 

Yes, you're right.

> order to implement authorization policies."

Yes, agreed again.

> RFCs 4732, 5280, and 6749 strike me as Informative, not Normative

Yes, yes, and yes. Assuming Ning and others agree, these are all easy changes.

Scott

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Wed, 29 May 2013 11:35:32 -0700

> > have no objection to keeping them separate.
My own view:

If one were to remove all of the HTTP specific stuff from this draft (which
is actually not all that much), it remains a security considerations and
requirements guide for providing RDAP service, ostensibly over some other
transport.  All of the remaining text would still be pertinent.  To that
end, I like that they're separate.

That's not a particularly strong opinion though.  If the WG would like to
merge them, I'd be fine with that.

-MSK

---

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 29 May 2013 19:58:35 +0000

I tend to think of the security document as being applicable to more than just the http document, but as you say I don't have a strong opinion on standalone vs. integrated. The text just needs to exist somewhere.

Scott

From: Murray S. Kucherawy [mailto:[email-masked]]
Sent: Wednesday, May 29, 2013 2:36 PM
To: Hollenbeck, Scott
Cc: Pete Resnick; [email-masked]
Subject: Re: [weirds] AD Evaluation of draft-ietf-weirds-rdap-sec-03

> have no objection to keeping them separate.

My own view:
If one were to remove all of the HTTP specific stuff from this draft (which is actually not all that much), it remains a security considerations and requirements guide for providing RDAP service, ostensibly over some other transport.  All of the remaining text would still be pertinent.  To that end, I like that they're separate.
That's not a particularly strong opinion though.  If the WG would like to merge them, I'd be fine with that.

-MSK

---

From: Ning Kong <[email-masked]>
Date: Wed, 29 May 2013 22:49:51 -0400

> Yes, yes, and yes. Assuming Ning and others agree, these are all easy changes.
+1, +1 and +1.

Ning