Subject: [secdir] review of draft-ietf-cdni-use-cases-08

From: Leif Johansson <[email-masked]>
Date: Sun, 08 Jul 2012 22:12:41 +0200

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The document is well written. The security considerations section
refers the reader to the CDNI problem statement which is fine if
all the security considerations from RFC3570 (which is obsoleted
by this document) are carried over to the CDNI problem statement.

	Best R
	Leif

---

From: "Francois Le Faucheur (flefauch)" <[email-masked]>
Date: Mon, 9 Jul 2012 08:05:17 +0000

(speaking as WG co-chair)

Hi Leif & use-cases co-authors,

Thanks for your review.

Regarding :
"The security considerations section
refers the reader to the CDNI problem statement which is fine if
all the security considerations from RFC3570 (which is obsoleted
by this document) are carried over to the CDNI problem statement."

I would say that the fundamental security considerations brought up in RFC3570 are indeed covered by the Problem Statement. But arguably, there are one or two interesting specific declinations of these fundamental security considerations that are more explicitely spelt out in RFC3570 (eg "Delivery of Bad CONTENT"). My proposal would be that we catch all these "specific declinations" in our CDNI Framework document, since this is the target document for discussing specific declinations of system-level security issues (and each individual CDNI interface document will discuss its interface-specific considerations). 
Does that work?
If yes, I'll drop a note to the CDNI Framework authors to make sure they exhaustively catch any specific declinations of security issues that was brought up in RFC3570 and is not yet discussed in the CDNI Framework.

Cheers

Francois

On 8 Jul 2012, at 22:12, Leif Johansson wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
> 
> iEYEARECAAYFAk/56bkACgkQ8Jx8FtbMZneEEACfSx3EDC8LjfxAVtjlG26U0yke
> A/4AniNhNV6H7bR5HCqfisT2mZ2lFgp0
> =UlPC
> -----END PGP SIGNATURE-----

---

From: Leif Johansson <[email-masked]>
Date: Mon, 09 Jul 2012 10:07:20 +0200

On 07/09/2012 10:05 AM, Francois Le Faucheur (flefauch) wrote:
> Regarding : "The security considerations section refers the reader
> to the CDNI problem statement which is fine if all the security
> considerations from RFC3570 (which is obsoleted by this document)
> are carried over to the CDNI problem statement."
> 
> I would say that the fundamental security considerations brought up
> in RFC3570 are indeed covered by the Problem Statement. But
> arguably, there are one or two interesting specific declinations of
> these fundamental security considerations that are more explicitely
> spelt out in RFC3570 (eg "Delivery of Bad CONTENT"). My proposal
> would be that we catch all these "specific declinations" in our
> CDNI Framework document, since this is the target document for
> discussing specific declinations of system-level security issues
> (and each individual CDNI interface document will discuss its
> interface-specific considerations). Does that work? If yes, I'll
> drop a note to the CDNI Framework authors to make sure they
> exhaustively catch any specific declinations of security issues
> that was brought up in RFC3570 and is not yet discussed in the CDNI
> Framework.

Great