Subject: Re: req't, security related comments (CORRECTED)

From: "Ryan Moats" <[email-masked]>
Date: Thu, 19 Apr 2001 20:17:39 -0500

| [this post corrects a few typos including a key reference]
| 
| I suggest the term "data privacy" be replaced with "data
| confidentiality" within the requirements document as
| "data privacy" is somewhat confusing.  I highly recommend
| use of RFC 2828 terminology be used in describing security
| requirements.
|
| > S1.  During initiation of a replication session, authentication and
| > verification of authorization of both the replica and the source
| > directory MUST be allowed before any data is transferred.
|
| I would suggest a cleaner wording:
| 
| S1.  The protocol MUST support mutual authentication and verification
| of authorization of the protocol's peers before allowing
| replication data transfer.
|
| > S2.  The transport for LDAP synchronization MUST permit assurance of
| > the integrity and privacy of all data transferred.
|
| S2.  The replication protocol MUST support transfer of data with
| integrity and confidentiality protection.
|
| (I note this broadens the requirement)
|
| > S3.  To promote interoperability, there MUST be a mandatory-to-
| > implement data privacy mechanism.
|
| S3.  To promote interoperability, there MUST be a mandatory-to-
| implement data integrity and confidentiality protection mechanism.
|
| > S4. The transport for administrative access MUST permit assurance of
| > the integrity and privacy of all data transferred.
|
| Due to the rewording of S2, this would be redundant.

I'm ok with all of the above suggestions.

| 5.  Security Considerations
| > As noted in Section 3, security may be impacted when replicating
| > among servers that implement non-standard extensions to basic
| > LDAP semantics.
|
| I note that security is also impacted by servers implementing
| standard extensions as well as differing optional features of the
| "core" protocol as well as by implementing same features in
| different ways.
|
| That is, the section 3 section:
| > Interoperability among directories using LDUP replication may be
| > limited for implementations that add semantics beyond those specified
| > by the LDAP core documents (RFC 2251-2256, 2829, 2830).
|
| I believe this should be broaden to say:
|   Interoperability among directories using LDUP replication may be
|   limited for implementations that add semantics beyond those specified
|   by the LDAP core documents (RFC 2251-2256, 2829, 2830), or implement
|   differing sets of optional features of the LDAP, or implement them
|   in differently.
|
| I don't see why the document doesn't just say:
|   Interoperability between independently developed server
|   implementations of LDAP using LDUP may be limited as LDAP
|   has numerous optional features and extensions and allows
|   for a wide range of implementation behavior.

However, I do not agree with either of these wordings.  IMHO, it is the
responsibility of LDUP to handle all of the optional features of LDAP
already documented while to me the above suggestions read as a pass.
New experimental or optional features of LDAP (from when LDUP is
published) are themselves required to address any impact they have on
replication.

Ryan

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Thu, 19 Apr 2001 20:04:53 -0700

>already documented while to me the above suggestions read as a pass.

It's not a pass, its a realization that LDUP will not remove
allowed differences between LDAP implementations and these
differences can have significant impact upon security in
replicated environments.