Subject: Re: [weirds] AD Evaluation of draft-ietf-weirds-rdap-sec-03

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 3 Jun 2013 16:29:46 +0000

I just posted draft-ietf-weirds-rdap-sec-04 to address Pete's comments.

Scott

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
> Behalf Of Pete Resnick
> Sent: Wednesday, May 29, 2013 12:36 PM
> To: [email-masked]
> Subject: [weirds] AD Evaluation of draft-ietf-weirds-rdap-sec-03
> 
> As with -using-http, please give the authors and/or Murray the chance
> to
> respond first:
> 
> Overall, I'm not clear on why this wasn't folded in to the -using-http
> document, more or less as the security considerations section, but I
> have no objection to keeping them separate.
> 
> Section 3.1:
> 
>     RDAP MUST include an authentication framework that can accommodate
>     anonymous access as well as verification of identities using a
> range
>     of authentication methods and credential services.
> 
> Specifying that a protocol MUST do something (as against an
> implementation or an actor in the protocol) is...weird. Don't you
> really
> mean, "RDAP's authentication framework needs to accomodate..."? There
> are no specific protocol/implementation requirements here.
> 
> Section 3.2:
> 
>     RDAP MUST include an authorization framework that is capable of
>     providing granular (per registration data object) access controls
>     according to the policies of the operator.
> 
> The same as in 3.1. I suggest, "An RDAP server MUST provide granular
> access controls (that is, on a per registration data object basis) in
> order to implement authorization policies."
> 
> RFCs 4732, 5280, and 6749 strike me as Informative, not Normative
> references.
> 
> pr
> 
> --
> Pete Resnick<http://www.qualcomm.com/~presnick/>
> Qualcomm Technologies, Inc. - +1 (858)651-4478
> 
> _______________________________________________
> weirds mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/weirds