Subject: [secdir] Review of draft-ietf-dime-diameter-api-08

From: Sean Turner <[email-masked]>
Date: Tue, 16 Jun 2009 11:43:38 -0400

I have reviewed this document (twice now) as part of the security 
directorate's ongoing effort to review all IETF documents being 
processed by the IESG. These comments were written primarily for the 
benefit of the security area directors. Document editors and WG chairs 
should treat these comments just like any other last call comments.

This version does not address the comments I made against the -07 
version, notably:

The document needs to discuss the security considerations surrounding 
the API in your document, as opposed to just pointing to RFC5388.

Nits:
- Sec 3.1.1: add "." to end of last sentence
- Sec 3.4.3.1 and 3.4.3.2: r/- The NAI of the user./The NAI of the user.
- Sec 3.4.5.7: Move description before C code.

spt

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Tue, 16 Jun 2009 18:30:04 +0200

Sean,

Was your review sent to the editors of the document? 

Can you please clarify why you believe that the API introduces
supplementary security concerns, which would make the reference to the
security considerations of RFC 5366 insufficient? 

Thanks and Regards,

Dan

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On 
> Behalf Of Sean Turner
> Sent: Tuesday, June 16, 2009 6:44 PM
> To: secdir; [email-masked]; 
> [email-masked]; [email-masked]
> Cc: Hannes Tschofenig
> Subject: Review of draft-ietf-dime-diameter-api-08
> 
> I have reviewed this document (twice now) as part of the 
> security directorate's ongoing effort to review all IETF 
> documents being processed by the IESG. These comments were 
> written primarily for the benefit of the security area 
> directors. Document editors and WG chairs should treat these 
> comments just like any other last call comments.
> 
> This version does not address the comments I made against the 
> -07 version, notably:
> 
> The document needs to discuss the security considerations 
> surrounding the API in your document, as opposed to just 
> pointing to RFC5388.
> 
> Nits:

---

From: Sean Turner <[email-masked]>
Date: Tue, 16 Jun 2009 13:01:15 -0500

Dan,

I sent the review to Pat and to Dave (and the iesg and secdir).  I see 
that Victor was also added during the last go around so if he made the 
changes I'm not sure he would have seen them.

My concern is that the document is for the Diameter API but the security 
considerations points to the Diameter Protocol.  So, we don't have any 
security considerations at all if we just point to the protocol 
definition, which is what the document does now.

spt

---

From: "Romascanu, Dan (Dan)" <[email-masked]>
Date: Wed, 17 Jun 2009 14:12:18 +0200

Sean,

I will let the authors infirm or confirm what I am saying, but my
understanding is that they take the position that the document describes
an internal API  for applications to access the Diameter protocol, and
that there is no additional security threat involved in the definition
or implementation of such an API. 

Dan

> From: Sean Turner [mailto:[email-masked]] 
> Sent: Tuesday, June 16, 2009 9:01 PM
> To: Romascanu, Dan (Dan)
> Cc: secdir; [email-masked]; 
> [email-masked]; [email-masked]; Hannes Tschofenig; 
> Victor Fajardo; [email-masked]; [email-masked]
> Subject: Re: Review of draft-ietf-dime-diameter-api-08
> 
> Dan,
> 
> I sent the review to Pat and to Dave (and the iesg and 
> secdir).  I see that Victor was also added during the last go 
> around so if he made the changes I'm not sure he would have seen them.
> 
> My concern is that the document is for the Diameter API but 
> the security considerations points to the Diameter Protocol.  
> So, we don't have any security considerations at all if we 
> just point to the protocol definition, which is what the 
> document does now.
> 
> spt
> 
> >> From: [email-masked] [mailto:[email-masked]] 
> On Behalf 
> >> Of Sean Turner
> >> benefit of the security area directors. Document editors and WG 
> >> chairs should treat these comments just like any other last call 
> >> comments.
> >>
> surrounding

---

From: Victor Fajardo <[email-masked]>
Date: Tue, 16 Jun 2009 17:41:59 -0400

Hi Dan,

> or implementation of such an API. 

Yes. This is our understanding as well. Defining functions and 
structures does not seem to introduce any security concerns to us. It is 
possible that implementors introduced security vulnerabilities when 
implementing internals of the API's (etc. bug in code, weak algorithms, 
data structures that will not scale etc.). However, these are outside 
the scope of the document. If this is something to be clarified then we 
can add text stating this.

regards,
victor

>>> supplementary security concerns, which would make the 
>>>       
>> reference to the 
>>     
>>>> processed by the IESG. These comments were written 
>>>>         
>> primarily for the 
>>

---

From: Sean Turner <[email-masked]>
Date: Sun, 21 Jun 2009 13:21:31 -0400

Dan,

If this is the case, then I'd suggest adding something to make it 
explicit that the API adds no additional security concerns.

spt

---

From: David Frascone <[email-masked]>
Date: Mon, 22 Jun 2009 17:36:32 -0400

Ok.  Will do.

-Dave

On Sun, Jun 21, 2009 at 1:21 PM, Sean Turner<[email-masked]> wrote:
> Dan,
>
> If this is the case, then I'd suggest adding something to make it explicit
> that the API adds no additional security concerns.
>
> spt
>
>>> From: Sean Turner [mailto:[email-masked]] Sent: Tuesday, June 16, 2009
>>> 9:01 PM
>>> To: Romascanu, Dan (Dan)
>>> Cc: secdir; [email-masked]; [email-masked];
>>> [email-masked]; Hannes Tschofenig; Victor Fajardo; [email-masked];
>>> [email-masked]
>>> security considerations at all if we just point to the protocol definition,
>>> which is what the document does now.
>>>
>>> spt
>>>
>>>>> directorate's ongoing effort to review all IETF documents being processed by
>>>>> the IESG. These comments were written
>>>
>>> primarily for the
>>>>>