Subject: [secdir] SECDIR Review: draft-ietf-lemonade-architecture-04

From: Stefan Santesson <[email-masked]>
Date: Tue, 11 Nov 2008 14:53:03 +0000

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document specifies the architecture for mobile email, as described by the Open Mobile Alliance (OMA), using Internet Mail protocols.  This architecture was an important consideration for much of the work of the LEMONADE (Enhancements to Internet email to Support Diverse Service Environments) work group in the IETF.  This document also describes how the LEMONADE architecture meets the OMA's requirements for their Mobile Email (MEM) service.

General comments:
I have not reviewed the presented architecture as such.
The Security consideration of this document is very short and does not provide me with the basic information I would like to find.
This security consideration lists a number of security areas that may apply to the architecture and the protocols where these security issues are dealt with.
What I would find more useful would be an informative text telling me if the architecture specified in THIS document introduce any new security issues and whether resolutions of those issues are within or outside the scope of this specification.

Stefan Santesson
Senior Program Manager
Windows Security, Standards

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: "eburger" <[email-masked]>
Date: Tue, 11 Nov 2008 15:23:29 +0000

You are correct: this document has no security issues in itself; the Security Considerations section is really a road map for the rest of the lemonade work (almost completed). 

Can we leave the document as is, or should we just say, "this document does not introduce any security considerations in itself. See the protocol documents themselves for any security issues."? Our preference is to let it lie, but we are open to suggestions. 

Thanks for your review. 

--
Eric Burger

Sent from my mobile device; sorry if terse. All mobile users need lemonade.  See <http://www.standardstrack.com/ietf/lemonade> for more information.

-----Original Message-----
From: Stefan Santesson <[email-masked]>

Date: Tue, 11 Nov 2008 14:53:03 
To: [email-masked]<[email-masked]>; [email-masked]<[email-masked]>; Chris Newman<[email-masked]>; Glenn Parsons<[email-masked]>; Eric Burger<[email-masked]>
Subject: SECDIR Review: draft-ietf-lemonade-architecture-04

General comments:

Stefan Santesson
Senior Program Manager

---

From: Stefan Santesson <[email-masked]>
Date: Wed, 12 Nov 2008 09:02:58 +0000

Hi Eric,

You could also leave the current text as it is but add the sentence you proposed “this document does not introduce any security considerations in itself” to clarify.
Personally I think it would make your document better, but whether this is necessary is totally up to you and the IESG.

Stefan Santesson
Senior Program Manager

From: eburger [mailto:[email-masked]]
Sent: den 11 november 2008 16:23
To: Stefan Santesson; [email-masked]; [email-masked]; Chris Newman; Glenn Parsons
Subject: Re: SECDIR Review: draft-ietf-lemonade-architecture-04

Thanks for your review.

--
Eric Burger

________________________________
From: Stefan Santesson <[email-masked]>
Date: Tue, 11 Nov 2008 14:53:03 +0000
To: [email-masked]<[email-masked]>; [email-masked]<[email-masked]>; Chris Newman<[email-masked]>; Glenn Parsons<[email-masked]>; Eric Burger<[email-masked]>
Subject: SECDIR Review: draft-ietf-lemonade-architecture-04
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

General comments:

Stefan Santesson
Senior Program Manager