Subject: [secdir] secdir review of review-draft-ietf-nfsv4-rpc-netid-03.txt

From: Juergen Schoenwaelder <[email-masked]>
Date: Thu, 27 Nov 2008 09:50:45 +0100

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The document defines IANA registries for two parameters used in the
RPC binding protocol (r_netid and r_addr) [RFC1833] and as such does
not have any impact on network security by itself. However, the
current text in the Security Considerations section

   See section 9 of [7].

(where [7] means RFC 5226) should in my view be improved / replaced
since the text referred to does not really apply. Here is a proposal
of some text that might be a starting point for more meaningful
security considerations text:

   Since this document is only concerned with the IANA management of
   the Network Identifier (netid) and Universal Network Addresses
   (uaddrs) format registry, it raises no new security issues.

While taking a look at RFC 1833, I learned that RFC 1833 does not
discuss security issues at all. Is there a document discussing
security issues of the RPC Binding protocol?  I could not find
one. Are there any plans to revise RFC 1833? It seems to me that a
decent discussion of the security aspects of the Binding protocol is
somewhat important to have somewhere. This is a general observation I
like to share but not specific to the document I have reviewed.

Editorial comment:

I found the introduction and some other parts of the document
difficult to read. Sentences like "Since the publication of [2], it
has been found to be necessary that protocols like [5] and [6] ..."
caused to me to flip pages several times. I suggest to be a bit more
verbose to make it easier for readers, e.g. "Since the publication of
the RPC Bind protocol [RFC1833], it has been found to be necessary
that protocols like NFS version 4 [RFC3530] and Remote Direct Memory
Access [ID-RDMA] ...

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>
_______________________________________________
secdir mailing list
[email-masked]
https://mailman.mit.edu/mailman/listinfo/secdir
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir