Re: Last Call: 'A Lightweight UDP Transfer Protocol for the the Internet Registry Information Service' to Proposed Standard (draft-ietf-crisp-iris-lwz)

[Mark Townsley <townsley at cisco.com>]

Sam Hartman wrote:
> I notice that this transport provides no authentication of the data
> that is retrieved.
>
> The security considerations needs to discuss the potential attacks if
> an attacker modifies this public data.  The security considerations
> section also needs to point to best practice for avoiding UDP
> reflection attacks.  It is not good enough to say "Do what other
> people do."
>
>
> In both cases these may be included by reference.
>   

I noticed this in the draft:

"   1.  If a request requires authentication, confidentiality, or other
       security, use another transfer protocol."

It seems to me that the intent is to not provide authentication here. This seems more fundamental than a fix by reference.

In a different vein, we have:

"  Its message exchange
  pattern is simple: a client sends a request in one UDP packet, and a
  server responds with an answer in one UDP packet."

I see no mention of what to do if the one UDP packet is lost. 
Resend? After how long? Exponentially backoff? 

- Mark



_______________________________________________
Ietf mailing list
Ietf at ietf.org
https://www1.ietf.org/mailman/listinfo/ietf