Subject: [secdir] secdir review of draft-sparks-genarea-imaparch

From: Carl Wallace <[email-masked]>
Date: Sun, 05 May 2013 10:00:22 -0400

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments
just like any other last call comments.

This draft describes the requirements for providing an IMAP interface for
IETF mail archives.  The first item in the security considerations is
correct, but in general the security considerations seem too narrowly
focused on searching and storage.  Some discussion of the following may be
worthwhile: how the server is authenticated to users, how users are
authenticated to the server (unless the reference to the datatracker
system is viewed as sufficient), details of the interface with the
datatracker authentication system, (maybe) how archive integrity is
maintained, identification of what should or should not be logged.

---

From: Robert Sparks <[email-masked]>
Date: Tue, 07 May 2013 14:07:08 -0500

Thanks Carl -

The details of how this authentication will be managed is probably 
diving a little deep
for the conversations this draft is hoping to inform. Pointing to 
integrating with the datatracker
should be enough, but if there is something _specific_ (in particular 
specific to IMAP) that we
want to constrain the design discussions with, let me know.

RjS