Subject: [XCON] correction to section 8.2 question

From: Michael Bober <[email-masked]>
Date: Mon, 27 Apr 2009 12:39:36 -0500

To clarify, the following question I submitted was in refference to
"draft-ietf-xcon-common-data-model-13.txt":

Section 8.2 discusses confidentiality, and it seems that encryption and
end-to-end authentication provide the most protection for XCON.  Since
hacking has been quite newsworthy in the recent weeks, I am interested to
know what kind of attack XCON would be susceptible to, if any.

Michael Bober

---

From: "Oscar Novo" <[email-masked]>
Date: Tue, 28 Apr 2009 09:48:16 +0200

Well, I haven't think myself in all the possible attacks but the most
important ones related to confidentiality could be:
 
- An attacker may attempt to get access to confidential information from
eavesdropping.
 
- An attacker may attempt to modify the messages exchange btw the client
and server (that's more related to integrity though)
 
Oscar

________________________________

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Michael Bober
Sent: 27. huhtikuuta 2009 20:40
To: [email-masked]
Subject: [XCON] correction to section 8.2 question

Section 8.2 discusses confidentiality, and it seems that encryption and
end-to-end authentication provide the most protection for XCON.  Since
hacking has been quite newsworthy in the recent weeks, I am interested
to
know what kind of attack XCON would be susceptible to, if any.

Michael Bober

---

From: "Mary Barnes" <[email-masked]>
Date: Tue, 28 Apr 2009 08:54:13 -0500

Hi Michael,
 
The XCON FW (RFC 5239)  provides an overview of the potential attacks
for XCON, as well as some basic security mechanisms that should be
supported by a conferencing system and conferencing client. 
 
We will need to provide a detailed description of the security solution
for the XCON protocol in the CCMP protocol document:
http://tools.ietf.org/id/draft-ietf-xcon-ccmp-02.txt
 
Since the protocol is based on HTTP(S), we will be relying on some of
the HTTP security mechanisms. 
 
We'll be updating the security section in the next revision and will
take your comment into consideration and we'd appreciate additional
feedback once we submit the revision.
 
Thanks,
Mary. 

From: [email-masked] [mailto:[email-masked]] On Behalf Of
Oscar Novo
Sent: Tuesday, April 28, 2009 2:48 AM
To: Michael Bober; [email-masked]
Subject: Re: [XCON] correction to section 8.2 question

 
 
Oscar

 

Michael Bober