Subject: [Ecrit] Update of security draft

From: "Tom-PT Taylor" <[email-masked]>
Date: Wed, 12 Jul 2006 14:12:42 -0400

Here are the exact changes made going from security-threats-02 to 
security-threats-03. Please advise of any concerns before the Chairs 
pass this draft to the IESG.

1. Abstract, final sentence: corrected typos "identified", extra "the".

2. Introduction first para last two sentences: [emergency marker and 
protocol "must be defined" changed to "is being defined" in each case.

3. Changed punctuation on second and fifth bullets of section 4.

4. Section 5.1, para following the last bullet, final sentence: added

    ", or there could be location information, but it is false".

5. Section 6, response to attack involving corruption of the mapping 
database:

Old text:
    Requirement: to provide an audit trail, the protocol SHOULD allow the
    inclusion of an identifier in its response that indicates which
    database records were used in preparing the response.  This
    identifier SHOULD be encrypted along with randomizing information
    such as date/time, to minimize the information provided to an
    attacker in mapping responses.

New text:
    Requirement: the protocol SHOULD include information in the response
    that allows subsequent correlation of that response with internal
    logs that may be kept on the mapping server, to allow debugging of
    mis-directed calls.  One example of a way to meet this requirement
    would be by means of an opaque parameter in the returned URI.

6. Acknowledgements: added Ron Watro and corrected Kamran Aquil's name.

I note that the reference to the requirements document will have to be 
fixed eventually, but that can be done any time up to AUTH 48.

Tom Taylor

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit