Subject: Re: [secdir] Review of draft-ietf-xcon-common-data-model-28.txt

From: Tero Kivinen <[email-masked]>
Date: Wed, 1 Jun 2011 17:58:28 +0300

[CC'ing back to original recipient list, as all my issues have been
solved].

Oscar Novo writes:
> Thanks for your reply. I've created a new version of the draft with
> your suggestions.  
> Do you think the document is more clear now?

Yes.

>    It is RECOMMENDED the database uses encryption mechanisms if the
>    information is stored in long term storage (e.g., disk).  If the
>    database contains sensitive elements (e.g., passwords) the
>    confidentiality of the database MUST be protected from unauthorized
>    users.  If no sensitive elements is present then confidentiality is
>    not needed.

I think the above text is clear and solves my issue. 

>    Note that the specification of the privacy policy is outside the
>    scope of this document.  Saying that, a privacy policy will be needed
>    in the real implementation of the data model and, therefore, is
>    subject to future policy documents.

I think this is the minimal text what is needed. It could provide bit
more information about what kind of elements in data model and what
kind of issues privacy policy would need to cover, but that would
require more work to find that information out.

So I think that change will solve my issue. 
-- 
[email-masked]