Subject: [weirds] Security Requirements

From: "Hollenbeck, Scott" <[email-masked]>
Date: Mon, 8 Oct 2012 12:39:38 +0000

In the interest of trying to get some discussion going I'd like to start some threads focused on security requirements. I intend to capture requirements in the RDAP security draft so that the requirements can be used to assess protocol needs. I'm going to start a few threads to discuss requirements that I've found in multiple sources over the past few years. We can add to or delete items from the lists as we see fit.

Here's a sample of the sources I found:

- RFC 3707, "Cross Registry Internet Service Protocol (CRISP) Requirements"

- SSAC 23, 27, 33, 40

- Inventory of WHOIS Service Requirements Final Report (Sheng, Piscitello, and Gasster July 2010)

If you read these documents and others focused on WHOIS security you'll find much discussion of topics like "privacy" and "data accuracy". My contention is that our focus should be on protocol security that supports operational security, but (for example) how registries validate data supplied by clients is out of scope. We should specify protocol security that supports operational security.

I'm going to describe security services using terms defined in RFC 4949. Please review that document if you haven't read it recently.

Scott