Subject: [Roll] [roll] #122: draft-ietf-roll-security-threats-01.txt --- CIA model fails to differentiate authentication, integrity, and authorization

From: "roll issue tracker" <[email-masked]>
Date: Wed, 08 May 2013 18:18:25 -0000

#122: draft-ietf-roll-security-threats-01.txt --- CIA model fails to
differentiate authentication, integrity, and authorization

 Comments done by Stephen Kent (SK),source:[http://www.ietf.org/mail-
 archive/web/secdir/current/msg03712.html] and [http://www.ietf.org/mail-
 archive/web/secdir/current/msg03848.html][[BR]]
 Comments done by Sean Turner (ST),source:
 [https://datatracker.ietf.org/doc/draft-ietf-roll-security-
 threats/ballot/]

 === Section 3.1/3.2[[BR]]
 * 3.2 – One shortcoming of the “CIA” model is that it fails to
 differentiate authentication from integrity, and it also does not
 explicitly include authorization. This shortcoming shows up in the
 discussion on page 9. Use of the IS0 7498-2 security service terms might
 have yielded a better outcome, although that list also is not perfect. The
 introduction of the term “misuse” under the heading of integrity strikes
 me as inappropriate. I disagree that  non-repudiation might be relevant
 here.  This security service (defined in ISO 6498-2) applies to people and
 organizations, not to devices.-- by SK[[BR]]
 * s1/s3/3.1/3.2: The CIA model is one that's great, but in s3 your list
 security services list starts off with "proper authorization for actions"
 and then talk about authentication next.  Clearly authorization and
 authentication need to be added in to s3.2 -no?  Any chance of just
 changing to the 5 (confidentiality, integrity, authentication, access
 control, and non-repudiation) listed in ISO 7498-2?  You ever get a stable
 international reference.  You don't need to have that awkward lead-in
 about non-repudiation in s3.2. and you'd only need to add one
 availability?  If you're going to stick with CIA then please add
 authorization and authentication in s3.2.-- by ST[[BR]]

 === Section 5.2[[BR]]
 * 5.2 – Again, distinguishing among integrity, authentication, and
 authorization might make for a clearer discussion. Adherence to the “CAI”
 model is causing these problems.-- by SK

-- 
-------------------------------------+-------------------------------------
 Reporter:                           |      Owner:
  [email-masked]          |  [email-masked]
     Type:  defect                   |     Status:  new
 Priority:  major                    |  Milestone:
Component:  security-threats         |    Version:
 Severity:  Active WG Document       |   Keywords:
-------------------------------------+-------------------------------------

Ticket URL: <https://svn.tools.ietf.org/wg/roll/trac/ticket/122>
roll <http://tools.ietf.org/wg/roll/>

---

From: Michael Richardson <[email-masked]>
Date: Fri, 24 May 2013 09:19:02 -0400

>>>>> "roll" == roll issue tracker <[email-masked]> writes:
    roll> * s1/s3/3.1/3.2: The CIA model is one that's great, but in s3 your list
    roll> security services list starts off with "proper authorization for actions"
    roll> and then talk about authentication next.  Clearly authorization and
    roll> authentication need to be added in to s3.2 -no?  Any chance of just
    roll> changing to the 5 (confidentiality, integrity, authentication, access
    roll> control, and non-repudiation) listed in ISO 7498-2?  You ever
    roll> get a stable

Are there some experts on ISO 7498-2 in the WG?

-- 
Michael Richardson <[email-masked]>, Sandelman Software Works 
IETF ROLL WG co-chair.    http://datatracker.ietf.org/wg/roll/charter/