Subject: [secdir] Review of draft-ietf-xcon-common-data-model-27.txt

From: Tero Kivinen <[email-masked]>
Date: Fri, 27 May 2011 15:08:33 +0300

This is re-review of the draft I already reviewed at 2011-03-03. The
current draft contains some small changes done since, but I do not
think it solves the issues I raised in my previous review:

1) The confidentiality is not mandatory even in the cases where the
   database contains sensitive elements (passwords), it is only
   SHOULD.

2) The privacy issues is not covered enough. The current version added
   specific pointer to the section 11.2 of RFC5239, but that only
   covers one very small privacy issue, i.e. anonymous access. It does
   not cover gathering sensitive privacy information in the database,
   i.e. who participated which conferences and with whom.

My previous review can be found in
http://www.ietf.org/mail-archive/web/secdir/current/msg02482.html 
-- 
[email-masked]

---

From: Tero Kivinen <[email-masked]>
Date: Fri, 27 May 2011 16:11:11 +0300

Oscar Novo writes:
> [ON] In the new version of the draft (28) I have changes the text a bit:
> 
>    "The confidentiality of the database SHOULD be protected from
>    unauthorized users, given that the data model contains a set of
>    sensitive elements (e.g., passwords), and it is RECOMMENDED the
>    database uses encryption mechanisms if the information is stored in
>    long term storage (e.g., disk)." 

I would think that SHOULD (or MAY) is ok if there is no sensitive
elements in the database, but if the database actually do contain
sensitive elements like password do you really think confidentiality
is not needed?

If so in which scenarios it would be ok to not use confidentiality
and not protect the sensitive data from unauthorized users?

Saying that data SHOULD be encrypted when stored to the disk is
actually ok, as I do think SHOULD is acceptable there, as I can see
several valid scenarios where the long term storage access can be
secure enough that encryption is not needed.

I do not see any real scnearios where unauthorized users needs to
given access to the sensitive elements.

> [ON] We don't think this document should solve questions as "who
> participated which conferences and with whom?". And in the working
> group was agree to leave the policy outside this document for future
> documents.

I do not think there is really problem to solve, but I think by nature
this database will have such information, and that information might
be stored to long term storage. I.e. if someone makes conferences
about the "human rights problems in country X", and invites people to
participate such conference, then that information is stored to the
database.

By keeping that information in database this database now contains
sensitive privacy information, which is not pointed out in this draft.

I think security considerations section should point out that some
information stored in the data model might be sensitive in addition to
obious things like passwords and identity of the anonymoys users. This
may include the information about identities of the people
participating specific conferences or who is communicating with who
(i.e. telecommuniations data retentation:
http://en.wikipedia.org/wiki/Telecommunications_data_retention).

The current data model for example is quite vague about how long the
information is stored. I.e. how long will the list of participants
given in the system. When will it be deleted etc. If this only assumes
that all information only covers the currently on-going events then
that is good, but in most cases I think some information might be
stored before the event even starts etc.

I do not think there is need to modify the actual data model, more
likely point out that there might be issues there which some people
might not even see immediately (as can be seen how hard it has been
for me to try to express what my concern is). 
-- 
[email-masked]

---

From: Oscar Novo <[email-masked]>
Date: Fri, 27 May 2011 14:46:47 +0200

Hi Tero,

Comment inline: 

-----Original Message-----
From: Tero Kivinen [mailto:[email-masked]] 
Sent: 27. toukokuuta 2011 15:09
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Review of draft-ietf-xcon-common-data-model-27.txt

This is re-review of the draft I already reviewed at 2011-03-03. The current draft contains some small changes done since, but I do not think it solves the issues I raised in my previous review:

[ON] We don't think this document should solve questions as "who participated which conferences and with whom?". And in the working group was agree to leave the policy outside this document for future documents.

---

From: Paul Hoffman <[email-masked]>
Date: Tue, 31 May 2011 11:55:00 -0700

I have reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the Security ADs.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document describes how PPP can support TRILL. The security considerations section of this very short document says, in essence, that there are innumerable security considerations brought into play by the layering interactions between PPP and IS-IS, and that seems about right. I do not see any particular new security considerations for this particular mixture of the two.

--Paul Hoffman