Subject: [weirds] FW: Richard Barnes' Discuss on draft-ietf-weirds-rdap-sec-04: (with DISCUSS)

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 23 Jul 2014 13:37:58 +0000

I'm sending this to the list to capture an open issue for rdap-sec. Please note my suggestion for text to be added to using-http.

Scott

-----Original Message-----
From: Hollenbeck, Scott [mailto:[email-masked]] 
Sent: Thursday, August 15, 2013 7:54 AM
To: Richard Barnes; The IESG
Cc: [email-masked]; [email-masked]
Subject: RE: Richard Barnes' Discuss on draft-ietf-weirds-rdap-sec-04: (with DISCUSS)

> -----Original Message-----
> From: Richard Barnes [mailto:[email-masked]]
> Sent: Wednesday, August 14, 2013 9:16 PM
> To: The IESG
> Cc: [email-masked]; draft-ietf-weirds-rdap-
> [email-masked]
> Subject: Richard Barnes' Discuss on draft-ietf-weirds-rdap-sec-04:
> (with DISCUSS)
> 
> Richard Barnes has entered the following ballot position for
> draft-ietf-weirds-rdap-sec-04: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-
> criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-weirds-rdap-sec/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> (1) The Authentication section should be Client Authentication, since
> that's all it covers.  Shouldn't there be some discussion of Server
> Authentication as well?

Thanks for the feedback, Richard. The section title is correct. The intention is to describe RDAP application of authentication security services for both clients and servers, so yes, I should add text to address server authentication. I don't think much is needed since we have no unique server authentication requirements beyond what we get with TLS. How about this?

"RDAP does not impose any unique server authentication requirements. The mechanisms provided by HTTP Over TLS fully address the needs of RDAP."

> (2) I don't see anything here or in draft-ietf-weirds-using-http that
> says that RDAP clients MUST support TLS.  Shouldn't that be the case,
> since HTTPS is the standard security mechanism?  You should probably
> also
> consider how this would impact requirements around URIs for RDAP
> services.

I'm going to suggest that such text should be added to using-http since that document addresses how clients and servers use HTTP to exchange information. An appropriate reference can be added to HTTP Over TLS and/or rdap-sec from using-http.

Scott