|
24 | 24 | "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-43\">DID method</a> specification <em class=\"rfc2119\">MUST</em> define how authorization is performed to\nexecute all operations, including any necessary cryptographic processes." |
25 | 25 | }, |
26 | 26 | { |
27 | | - "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-44\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-12\">DID controller</a>\ncreates a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-66\">DID</a> and its associated <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-93\">DID document</a>." |
| 27 | + "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-44\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-12\">DID controller</a>\ncreates a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-67\">DID</a> and its associated <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-94\">DID document</a>." |
28 | 28 | }, |
29 | 29 | { |
30 | | - "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-45\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" id=\"ref-for-dfn-did-resolvers-4\">DID resolver</a> uses a\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-67\">DID</a> to resolve a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-94\">DID document</a>, including how the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" id=\"ref-for-dfn-did-resolvers-5\">DID resolver</a> can verify the authenticity of the response." |
| 30 | + "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-45\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" id=\"ref-for-dfn-did-resolvers-4\">DID resolver</a> uses a\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-68\">DID</a> to resolve a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-95\">DID document</a>, including how the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-resolvers\" class=\"internalDFN\" id=\"ref-for-dfn-did-resolvers-5\">DID resolver</a> can verify the authenticity of the response." |
31 | 31 | }, |
32 | 32 | { |
33 | | - "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-46\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify what constitutes an update to a\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-95\">DID document</a> and how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-13\">DID controller</a> can update a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-96\">DID document</a> <em>or</em> state that updates are not possible." |
| 33 | + "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-46\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify what constitutes an update to a\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-96\">DID document</a> and how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-13\">DID controller</a> can update a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-97\">DID document</a> <em>or</em> state that updates are not possible." |
34 | 34 | }, |
35 | 35 | { |
36 | | - "html": "The <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-47\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-14\">DID controller</a> can\ndeactivate a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-68\">DID</a> <em>or</em> state that deactivation is not possible." |
| 36 | + "html": "The <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-47\">DID method</a> specification <em class=\"rfc2119\">MUST</em> specify how a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-controllers\" class=\"internalDFN\" id=\"ref-for-dfn-did-controllers-14\">DID controller</a> can\ndeactivate a <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-69\">DID</a> <em>or</em> state that deactivation is not possible." |
37 | 37 | } |
38 | 38 | ] |
39 | 39 | }, |
|
42 | 42 | "rationale": "if", |
43 | 43 | "steps": [ |
44 | 44 | { |
45 | | - "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-51\">DID method</a> specifications <em class=\"rfc2119\">MUST</em> follow all guidelines and normative\nlanguage provided in <a href=\"https://www.rfc-editor.org/rfc/rfc3552#section-5\">RFC3552: Writing Security\nConsiderations Sections</a> for the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-69\">DID</a> operations defined in the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-52\">DID method</a> specification." |
| 45 | + "html": "A <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-51\">DID method</a> specifications <em class=\"rfc2119\">MUST</em> follow all guidelines and normative\nlanguage provided in <a href=\"https://www.rfc-editor.org/rfc/rfc3552#section-5\">RFC3552: Writing Security\nConsiderations Sections</a> for the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-70\">DID</a> operations defined in the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-52\">DID method</a> specification." |
46 | 46 | }, |
47 | 47 | { |
48 | | - "html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> document the following forms of attack\nfor the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-70\">DID</a> operations defined in the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-53\">DID method</a> specification:\neavesdropping, replay, message insertion, deletion, modification, denial of\nservice, <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-amplification\" class=\"internalDFN\" id=\"ref-for-dfn-amplification-1\">amplification</a>, and man-in-the-middle. Other known\nforms of attack <em class=\"rfc2119\">SHOULD</em> also be documented." |
| 48 | + "html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> document the following forms of attack\nfor the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-71\">DID</a> operations defined in the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-53\">DID method</a> specification:\neavesdropping, replay, message insertion, deletion, modification, denial of\nservice, <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-amplification\" class=\"internalDFN\" id=\"ref-for-dfn-amplification-1\">amplification</a>, and man-in-the-middle. Other known\nforms of attack <em class=\"rfc2119\">SHOULD</em> also be documented." |
49 | 49 | }, |
50 | 50 | { |
51 | 51 | "html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> discuss residual risks, such as the\nrisks from compromise in a related protocol, incorrect implementation, or cipher\nafter threat mitigation was deployed." |
|
57 | 57 | "html": "If authentication is involved, particularly user-host authentication, the\nsecurity characteristics of the authentication method <em class=\"rfc2119\">MUST</em> be clearly\ndocumented." |
58 | 58 | }, |
59 | 59 | { |
60 | | - "html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> discuss the policy mechanism by which\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-71\">DIDs</a> are proven to be uniquely assigned." |
| 60 | + "html": "The Security Considerations section <em class=\"rfc2119\">MUST</em> discuss the policy mechanism by which\n<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-decentralized-identifiers\" class=\"internalDFN\" id=\"ref-for-dfn-decentralized-identifiers-72\">DIDs</a> are proven to be uniquely assigned." |
61 | 61 | }, |
62 | 62 | { |
63 | 63 | "html": "Method-specific endpoint authentication <em class=\"rfc2119\">MUST</em> be discussed. Where <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-54\">DID methods</a> make use of <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-distributed-ledger-technology\" class=\"internalDFN\" id=\"ref-for-dfn-distributed-ledger-technology-3\">DLTs</a> with varying network topology, sometimes\noffered as <em>light node</em> or <em>\n<a href=\"https://en.bitcoin.it/wiki/Thin_Client_Security\">thin client</a></em>\nimplementations to reduce required computing resources, the security assumptions\nof the topology available to implementations of the <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-55\">DID method</a> <em class=\"rfc2119\">MUST</em> be\ndiscussed." |
|
69 | 69 | "html": "Data which is to be held secret (keying material, random seeds, and so on)\n<em class=\"rfc2119\">SHOULD</em> be clearly labeled." |
70 | 70 | }, |
71 | 71 | { |
72 | | - "html": "<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-57\">DID method</a> specifications <em class=\"rfc2119\">SHOULD</em> explain and specify the implementation\nof signatures on <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-99\">DID documents</a>, if applicable." |
| 72 | + "html": "<a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-57\">DID method</a> specifications <em class=\"rfc2119\">SHOULD</em> explain and specify the implementation\nof signatures on <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-documents\" class=\"internalDFN\" id=\"ref-for-dfn-did-documents-100\">DID documents</a>, if applicable." |
73 | 73 | }, |
74 | 74 | { |
75 | 75 | "html": "Where <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-did-methods\" class=\"internalDFN\" id=\"ref-for-dfn-did-methods-58\">DID methods</a> use peer-to-peer computing resources, such as with all\nknown <a data-link-type=\"dfn|abstract-op\" href=\"https://www.w3.org/TR/did-1.1/#dfn-distributed-ledger-technology\" class=\"internalDFN\" id=\"ref-for-dfn-distributed-ledger-technology-4\">DLTs</a>, the expected burdens of those resources <em class=\"rfc2119\">SHOULD</em> be discussed\nin relation to denial of service." |
|
0 commit comments