Subject: Re: Going forward

From: Scott Bradner <[email-masked]>
Date: Thu, 12 Jun 1997 08:31:02 -0400

>  Scott's not waiting on anything?

I thought I was waiting on one of the IntServ docs
but I will check

Scott

---

From: Craig Partridge <[email-masked]>
Date: Thu, 12 Jun 97 08:31:19 -0700

I went and checked my back e-mail.

Controlled Load had a security section added as of May 28th (draft 05
circulated to the WG).

There was a lingering question about whether the RSVP use document required
any substantive security section.  My reading is that it does not.

[Scott, I was not clear if you want us to stuff the null security section
into those documents for which it is appropriate or whether that can wait
for IESG approval]

Craig

---

From: Fred Baker <[email-masked]>
Date: Thu, 12 Jun 1997 16:55:20 -0700

At 8:31 AM -0700 6/12/97, Craig Partridge wrote:
>Scott, I was not clear if you want us to stuff the null security section
>for IESG approval

I believe that one could write a section into rsvp-use that says

    Security Considerations

    We believe that there are no security issues in the use if Integrated
    Services objects by RSVP that are not inherent in the architecture. In
    other words, absent strong authentication and perhaps authorization to
    use RSVP services, RSVP is prone to denial of service and other attacks;
    absent those same features, the Integrated Services model is also proe
    to abuse. However, the current RSVP documents provide for authentication,
    and policy-based authorization is believed to be possible in the near
    future. Therefore, we believe that the existing holes have been
    addressed.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Today's vocabulary enhancement:
	"yuppie food coupons" = twenty dollar bills from an ATM