Subject: [weirds] FW: Sean Turner's Discuss on draft-ietf-weirds-rdap-sec-04: (with DISCUSS)

From: "Hollenbeck, Scott" <[email-masked]>
Date: Wed, 23 Jul 2014 13:39:15 +0000

I'm sending this to the list to capture an open issue for rdap-sec.
Scott

Scott

-----Original Message-----
From: Hollenbeck, Scott [mailto:[email-masked]] 
Sent: Thursday, August 15, 2013 8:09 AM
To: Sean Turner; The IESG
Cc: [email-masked]; [email-masked]
Subject: RE: Sean Turner's Discuss on draft-ietf-weirds-rdap-sec-04: (with DISCUSS)

> -----Original Message-----
> From: Sean Turner [mailto:[email-masked]]
> Sent: Wednesday, August 14, 2013 8:35 PM
> To: The IESG
> Cc: [email-masked]; draft-ietf-weirds-rdap-
> [email-masked]
> Subject: Sean Turner's Discuss on draft-ietf-weirds-rdap-sec-04: (with
> DISCUSS)
> 
> Sean Turner has entered the following ballot position for
> draft-ietf-weirds-rdap-sec-04: Discuss
> 
> When responding, please keep the subject line intact and reply to all
> email addresses included in the To and CC lines. (Feel free to cut this
> introductory paragraph, however.)
> 
> 
> Please refer to http://www.ietf.org/iesg/statement/discuss-
> criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> http://datatracker.ietf.org/doc/draft-ietf-weirds-rdap-sec/
> 
> 
> 
> ----------------------------------------------------------------------
> DISCUSS:
> ----------------------------------------------------------------------
> 
> s3.1 contains the following:
> 
>  To that end, RDAP clients and
>    servers MUST implement the authentication framework specified in
>    "HTTP Authentication: Basic and Digest Access Authentication"
>    [RFC2617].
> 
> Does that mean the client and server need to support both basic and
> digest?

Thanks for the feedback, Sean. A server needs to support one or the other. A client must be prepared to support both.

> s3.1: I think the gist here that should maybe be made clearer is that
> servers need MUST implement TLS with server side certificates - no?

If there is a need to protect plaintext credentials they MUST.

> What
> I'm curious about here is whether there should be a SRV-ID or URI-ID is
> needed for RDAP and isn't some kind of reference to RFC 6125 warranted
> here?

I'm open to suggestions. Whatever is appropriate for a web server would be appropriate for RDAP.

Scott