IETF conflict review for draft-goix-appsawg-enum-acct-uri
conflict-review-goix-appsawg-enum-acct-uri-00

The following approval message was sent
From: The IESG
To: "Nevil Brownlee" , draft-goix-appsawg-enum-acct-uri@tools.ietf.org
Cc: The IESG , , 
Subject: Results of IETF-conflict review for draft-goix-appsawg-enum-acct-uri-06

The IESG has completed a review of draft-goix-appsawg-enum-acct-uri-06
consistent with RFC5742.


The IESG has no problem with the publication of 'ENUM Service
Registration for acct URI'  as
an Experimental RFC.


The IESG has concluded that there is no conflict between this document
and IETF work.

The IESG would also like the RFC-Editor to review the comments in the
datatracker related to this document and determine whether or not they
merit incorporation into the document. Comments may exist in both the
ballot and the history log.

The IESG review is documented at:
http://datatracker.ietf.org/doc/conflict-review-goix-appsawg-enum-acct-uri/

A URL of the reviewed Internet Draft is:
http://datatracker.ietf.org/doc/draft-goix-appsawg-enum-acct-uri/

The process for such documents is described at
http://www.rfc-editor.org/indsubs.html

Thank you,

The IESG Secretary

[Ballot comment]

I'm curious: given the file-name, was this proposed to and
rejected by appsawg?

As a personal comment, I don't think its at all a good plan
to introduce yet more linkages between personal identifiers
which is precisely what this does. But that's for the ISE to
judge I guess.

I'm also not quite sure whether or not this draft does
what's called for in the security considerations of
draft-ietf-appsawg-acct-uri. But that's also for the ISE to
judge. I'm pretty sure this draft does not define the
security considerations fully, but I'm not sure if this
draft counts as a protocol making "use" of acct URIs.  (Were
it up to me, I'd say yes it is, and that the security
considerations ought be more thorough.)

  In addition, protocols that make use of 'acct' URIs are responsible
  for defining security considerations related to such usage, e.g., the
  risks involved in dereferencing an 'acct' URI, the authentication and
  authorization methods that could be used to control access to
  personal data associated with a user's account at a service, and
  methods for ensuring the confidentiality of such information.

I also note that 6117 says:

  However, in some cases, the inclusion of those protocols and URI
  Schemes into ENUM specifically could introduce new security issues.
  In these cases, those issues or risks MUST be covered in the
  "Security Considerations" section of the Enumservice Specification.
  Authors should pay particular attention to any indirect risks that
  are associated with a proposed Enumservice, including cases where the
  proposed Enumservice could lead to the discovery or disclosure of
  Personally Identifiable Information (PII).

If someone were to ask me, I'd say that this draft doesn't
fully cover that, but again that's for the ISE and relevant
designated expert to decide.

The draft draft-goix-appsawg-enum-acct-uri-06
is ready for publication from the Independent Stream.
Please ask IESG to review it, as set out in RFC 5742.

The following is some background for this draft, please forward it
to IESG along with this request ...

Its title is:
ENUM Service Registration for acct URI

Its abstract says:
"This document registers a Telephone Number Mapping (ENUM) service for
'acct:' URIs (Uniform Resource Identifiers)."

It was reviewed for me by Richard Shockey andLawrence Conroy.

It has IANA Considerations as follows:
This document requests the IANA registration of the Enumservice with
Type "acct" according to the definitions in this document, [RFC6116]
and [RFC6117].
I asked IANA to look at it, they asked Bernie Hoeneisen (Designated
Expert for the ENUM registry) to review it; Bernie has worked with
the draft authors to improve it, he has now approved it.

Thanks, Nevil (ISE)