Widget Description Exchange Service (WIDEX) Requirements
draft-ietf-widex-requirements-04

This document is no longer a WG document, because the WG closed.  The draft will expire at some point.  The tracker entry is getting marked as "dead", meaning the document is in stasis until the authors decide what to do with it and request publication again on a new basis.

[Ballot comment]
The authors were sent a SecDir Review by Charles Clancy on
  16-Jan-2007.  I have not seen a response to the review, which
  ought to be treated as any other Last Call comment.

[Ballot comment]
Section 3.5., paragraph 1:
>    The Transport Protocol is a protocol that just transports the Widex
>    Objects as a string of bits, without looking at them.

  The term "transport protocol" isn't used anywhere else in this
  document, but later sections talk about a "transport component" and
  the "WIDEX protocol". Are these the same thing?


Section 4.4., paragraph 1:
>    o  The Widex protocol MUST provide reliable delivery of Widex
>      Objects.  If this proves to be impractical in a given situation,
>      the protocol MUST provide the means for application to detect such
>      failures.

  The MUST in the first sentence needs to be replaced by a SHOULD, if
  the second sentence wants to talk about what happens if reliability
  isn't guaranteed.

[Ballot discuss]
The authors were sent a SecDir Review by Charles Clancy on
  16-Jan-2007.  I have not seen a response to the review, which
  ought to be treated as any other Last Call comment.

[Ballot discuss]
I did not see yet a SECDIR review of this document, maybe this is meantioned there, but it appears to me that the Security Considerations section is incomplete. Although the first paragraph in the section indicates that we deal with a threat model copmposed of multiple threats 'including the potential for unauthorized access to application services, monitoring of interactions by unauthorized third parties, spoofing of application services as a means to support phishing attacks, and denial of service attacks' the rest of the section deals only with privacy issues and does not set any architecture requirements that correspond to the complete threat model.