Subject: [weirds] Security Requirements: Data Confidentiality

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 15 Oct 2012 09:54:16 -0700

Posting this on Scott's behalf, as he's having difficulty getting this
message through to the list for some reason (but not others).  I've
sent a request to the Secretariat to investigate.

-MSK

> -----Original Message-----
> From: Hollenbeck, Scott
> Sent: Monday, October 15, 2012 10:10 AM
> To: [email-masked]'
> Subject: Security Requirements: Data Confidentiality
>
> I originally sent this message to the list on 10 October. I just
> noticed that it isn't in the archives, so I'm sending it again.
>
> From "Inventory of WHOIS Service Requirements Final Report":
>
> WHOIS services must provide mechanisms to protect the privacy of
> registrants.
>
> A WHOIS service must discourage the harvesting and mining of its data.
>
> From RFC 3707:
>
> When a value in an answer to a query is given, the protocol MUST be
> capable of tagging the value with the following labels:
>
> 1. do not redistribute
> 2. special access granted
>
> The documents referenced above describe these requirements in the
> context of protecting collected data. I have been unable to find any
> specific mention of a requirement to protect data while in transit
> between clients and servers, though it seems obvious that plaintext
> authentication credentials (if used) would need to be protected.
>
> Scott