Subject: [Netconf] Kathleen Moriarty's No Objection on draft-ietf-netconf-restconf-17: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Mon, 10 Oct 2016 19:25:19 -0700

Kathleen Moriarty has entered the following ballot position for
draft-ietf-netconf-restconf-17: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-netconf-restconf/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

The draft is nicely written, thank you for that.  I have a point in the
security consideration section that I think is important to clarify in
the draft.

Authentication for RESTconf - The method for HTTP authentication vary and
some are really bad (HTTP Basic, digest isn't too far behind it).  This
draft just requires some method, but I think a warning to research the
methods since they have widely varying security levels is important.  For
the HTTP Authentication methods, the RFCs cover the pitfalls well.  Here
is the sentence:

   Client
   authentication MUST be implemented using client certificates or MUST
   be implemented using an HTTP authentication scheme.

How about:
   Client
   authentication MUST be implemented using client certificates or MUST
   be implemented using an HTTP authentication scheme.  The strength of 
   these methods vary greatly and (certificates are recommended or HTTP
basic is not recommended).

Digest isn't great either, but at least not recommending basic would be
good.  There are also a few newer experimental HTTPAuth methods that
improve things, but are experimental.  One gets rid of stored passwords
(HOBA).

---

From: Andy Bierman <[email-masked]>
Date: Wed, 12 Oct 2016 09:48:05 -0700

Hi,

The new text is fine with me.

Andy

---

From: Kent Watsen <[email-masked]>
Date: Wed, 12 Oct 2016 19:03:52 +0000

Putting the finishing touches on Kathleen’s proposed text:

   Client
   authentication MUST be implemented using client certificates or MUST
   be implemented using an HTTP authentication scheme.  The strength of
   these methods vary greatly.  For example, use of a client certificate
   is RECOMMENDED, while HTTP Basic authentication [RFC7617] is
   NOT RECOMMENDED.

Also, I think the following sentence regrading NACM should be deleted, as
it’s not well connected to the paragraph and it’s already mentioned in
Section 2.5.

Thoughts?

Kent

From: Andy Bierman <[email-masked]>
Date: Wednesday, October 12, 2016 at 12:48 PM
To: Kathleen Moriarty <[email-masked]>
Cc: The IESG <[email-masked]>, "[email-masked]" <[email-masked]>, "[email-masked]" <[email-masked]>, "Ersue, Mehmet (Nokia - DE/Munich)" <[email-masked]>, "[email-masked]" <[email-masked]>
Subject: Re: Kathleen Moriarty's No Objection on draft-ietf-netconf-restconf-17: (with COMMENT)
Resent-From: <[email-masked]>
Resent-To: <[email-masked]>, <[email-masked]>, <[email-masked]>
Resent-Date: Wednesday, October 12, 2016 at 12:48 PM

Hi,

Andy

On Mon, Oct 10, 2016 at 7:25 PM, Kathleen Moriarty <[email-masked]<mailto:[email-masked]>> wrote:
Kathleen Moriarty has entered the following ballot position for
draft-ietf-netconf-restconf-17: No Objection

   Client

How about:
   Client

---

From: Kathleen Moriarty <[email-masked]>
Date: Wed, 12 Oct 2016 15:34:17 -0400

>    is RECOMMENDED, while HTTP Basic authentication [RFC7617] is
This looks good, thank you.

> *From: *Andy Bierman <[email-masked]>
> *Date: *Wednesday, October 12, 2016 at 12:48 PM
> *To: *Kathleen Moriarty <[email-masked]>
> *Cc: *The IESG <[email-masked]>, "[email-masked]" <
> [email-masked]>, "[email-masked]" <
> [email-masked]>, "Ersue, Mehmet (Nokia - DE/Munich)" <
> [email-masked]>, "[email-masked]" <[email-masked]>
> *Subject: *Re: Kathleen Moriarty's No Objection on
> draft-ietf-netconf-restconf-17: (with COMMENT)
> *Resent-From: *<[email-masked]>
> *Resent-To: *<[email-masked]>, <[email-masked]>, <[email-masked]>
> *Resent-Date: *Wednesday, October 12, 2016 at 12:48 PM
>
>
>
> Hi,
>
>
>

-- 

Best regards,
Kathleen