Re: [XCON] correction to section 8.2 question

["Mary Barnes" <mary.barnes at nortel.com>]

Hi Michael,

 

The XCON FW (RFC 5239)  provides an overview of the potential attacks for XCON, as well as some basic security mechanisms that should be supported by a conferencing system and conferencing client.

 

We will need to provide a detailed description of the security solution for the XCON protocol in the CCMP protocol document:

http://tools.ietf.org/id/draft-ietf-xcon-ccmp-02.txt

 

Since the protocol is based on HTTP(S), we will be relying on some of the HTTP security mechanisms.

 

We'll be updating the security section in the next revision and will take your comment into consideration and we'd appreciate additional feedback once we submit the revision.

 

Thanks,

Mary.

---

From: xcon-bounces at ietf.org [mailto:xcon-bounces at ietf.org] On Behalf Of Oscar Novo
Sent: Tuesday, April 28, 2009 2:48 AM
To: Michael Bober; xcon at ietf.org
Subject: Re: [XCON] correction to section 8.2 question

Well, I haven't think myself in all the possible attacks but the most important ones related to confidentiality could be:

 

- An attacker may attempt to get access to confidential information from eavesdropping.

 

- An attacker may attempt to modify the messages exchange btw the client and server (that's more related to integrity though)

 

Oscar

 

---

From: xcon-bounces at ietf.org [mailto:xcon-bounces at ietf.org] On Behalf Of Michael Bober
Sent: 27. huhtikuuta 2009 20:40
To: xcon at ietf.org
Subject: [XCON] correction to section 8.2 question

 

To clarify, the following question I submitted was in refference to "draft-ietf-xcon-common-data-model-13.txt":

 

Section 8.2 discusses confidentiality, and it seems that encryption and
end-to-end authentication provide the most protection for XCON.  Since
hacking has been quite newsworthy in the recent weeks, I am interested to
know what kind of attack XCON would be susceptible to, if any.

Michael Bober