Subject: [core] I-D Action: draft-ietf-core-resource-directory-25.txt

From: [email-masked]
Date: Mon, 13 Jul 2020 06:42:09 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Constrained RESTful Environments WG of the IETF.

        Title           : CoRE Resource Directory
        Authors         : Zach Shelby
                          Michael Koster
                          Carsten Bormann
                          Peter van der Stok
                          Christian Amsüss
	Filename        : draft-ietf-core-resource-directory-25.txt
	Pages           : 83
	Date            : 2020-07-13

Abstract:
   In many IoT applications, direct discovery of resources is not
   practical due to sleeping nodes, disperse networks, or networks where
   multicast traffic is inefficient.  These problems can be solved by
   employing an entity called a Resource Directory (RD), which contains
   information about resources held on other servers, allowing lookups
   to be performed for those resources.  The input to an RD is composed
   of links and the output is composed of links constructed from the
   information stored in the RD.  This document specifies the web
   interfaces that an RD supports for web servers to discover the RD and
   to register, maintain, lookup and remove information on resources.
   Furthermore, new target attributes useful in conjunction with an RD
   are defined.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-core-resource-directory/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-core-resource-directory-25
https://datatracker.ietf.org/doc/html/draft-ietf-core-resource-directory-25

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-core-resource-directory-25

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Christian Amsüss <[email-masked]>
Date: Mon, 13 Jul 2020 16:17:12 +0200

Hello Russ and Adam,

> https://datatracker.ietf.org/doc/draft-ietf-core-resource-directory/

the newly submitted -25 was uploaded to address the points you've
brought up in your respective reviews.

Most noteworthy -- especially because it may affect the secdir review --
are the changes to the security policies section that caught Major
Concerns around the use of concrete security mechanisms.  Discussion
during the April interim meeting[1] has shown that the text had caught a
drift towards giving concrete and detailled (and in some details wrong)
measures without consideration for the bigger picture, which encompasses
a variety of applications with a wild variety of assurances they may or
may not need from an RD.

Consequently, that section that previously stated which parts of the RD
are protected now describes aspects that an application should consider
when deciding on a particular security model to employ.

The remaining changes should be sufficiently described in the changelog
and copied below for completeness.

Thanks again for your reviews
Christian

[1]: https://datatracker.ietf.org/doc/minutes-interim-2020-core-02-202004161500/

Remaining change log:

*  Add concrete suggestions (twice as long as registrant number with
   retries, or UUIDs without) for random endpoint names

*  Point out that simple registration can have faked origins,
   RECOMMEND mitigation when applicable and suggest the Echo mechanism
   to implement it.

*  Reference existing and upcoming specifications for DDOS mitigation
   in CoAP.

*  Explain the provenance of the example's multicast address.

*  Make "SHOULD" of not manipulating foreign registrations a "should"
   and explain how it is enforced

*  Clarify application of RFC6570 to search parameters

*  Syntactic fixes in examples

*  IANA:

   -  Don't announce expected number of registrations (goes to write-
      up)

   -  Include syntax as part of a field's validity in entry
      requirements

*  Editorial changes

   -  Align wording between abstract and introduction

   -  Abbreviation normalization: "ER model", "RD"

   -  RFC8174 boilerplate update

   -  Minor clarity fixes

   -  Markup and layouting

-- 
To use raw power is to make yourself infinitely vulnerable to greater powers.
  -- Bene Gesserit axiom