Security: Add threat model for OCM - #398
Conversation
During discussion at IETF126 it became clear that being explicit about the threat model for OCM would be useful for implementers and reviewers alike. This patch introduces a threat model secion in each of the OCM documents, as well as a new paragraph that calls out to the security section of load bearing RFCs that OCM leans on.
|
I have been using lots of perplexity.ai to search for CVE and contexts for this 😄 It's a nice thing. Will post my review soon. |
|
This is very welcome, and definitely in the direction of IETF Drafts. I read a bit of RFC 3552 and I can see we could even include some kind of |
Oh, that is very nice, I had missed that RFC. Maybe we should even link to it? |
Make it explicit that the Sending and Recieving OCM server as well abortsprotocol servers are part of the trusted comput environment and that the threat model assumes that the OCM server is not compromised. The network, is untrusted as is other OCM servers on the network
I edited the threat model with RFC 3552 in mind, in another separate commit. I am in favor of adding a tabulation of risks, mitigations and residual risks btw. |
3 participants
During discussion at IETF 126 it became clear that being explicit about the threat model for OCM would be useful for implementers and reviewers alike. This patch introduces a threat model section in each of the OCM documents, as well as a new paragraph that calls out to the security section of load bearing RFCs that OCM leans on.