Sam Hartman wrote:
I notice that this transport provides no authentication of the data
that is retrieved.
The security considerations needs to discuss the potential attacks if
an attacker modifies this public data. The security considerations
section also needs to point to best practice for avoiding UDP
reflection attacks. It is not good enough to say "Do what other
people do."
In both cases these may be included by reference.
I noticed this in the draft:
" 1. If a request requires authentication, confidentiality, or other
security, use another transfer protocol."
It seems to me that the intent is to not provide authentication here. This seems more fundamental than a fix by reference.
In a different vein, we have:
" Its message exchange
pattern is simple: a client sends a request in one UDP packet, and a
server responds with an answer in one UDP packet."
I see no mention of what to do if the one UDP packet is lost.
Resend? After how long? Exponentially backoff?
- Mark
_______________________________________________
Ietf@xxxxxxxx
https://www1.ietf.org/mailman/listinfo/ietf