Subject: Re: [secdir] review of draft-ietf-tsvwg-iana-ports-09

From: Joe Touch <[email-masked]>
Date: Tue, 01 Feb 2011 11:16:48 -0800

Hi, Sandy,

On 2/1/2011 11:07 AM, Murphy, Sandra wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG. These comments were written primarily for the benefit of the
> security area directors. Document editors and WG chairs should treat
> these comments just like any other last call comments.
...
> There is a required format for communication of a request to the IANA, I
> presume by email. I did not see any mention of the email address to
> which the request should be sent (RFC5226 also doesn’t seem to mention it).

It's a web form. The doc refers to that in Sec 2:

    Information about the assignment procedures for the port registry has
    existed in three locations: the forms for requesting port number
    assignments on the IANA web site [SYSFORM][USRFORM], an introductory
    text section in the file listing the port number assignments
    themselves (known as the port numbers registry) [PORTREG], and two
    brief sections of the IANA Allocation Guidelines [RFC2780].

I.e., communication is initiated through the forms.

> The procedure requires that the same previous Assignee (or Contact) make
> any subsequent request about a port/name assignment, where the email
> address is provided in the request. Security question: how does the IANA
> know that it is communicating with the same Assignee/Contact? There’s no
> recommendation for security of that communication.

Can you clarify what that would mean? I am not aware of any IETF process 
that requires presenting credentials beyond an email address.

> In the IANA section there is a paragraph:
>
>       IANA is instructed to create a new service name entry in the service
>       name and port number registry [PORTREG] for any entry in the
>       "Protocol and Service Names"  registry [PROTSERVREG] that does not
>       already have one assigned.
>
> Are there no guidelines for creating the new service name?

See Sec 8.1. The new assignment procedure allows for service names to be 
requested without port numbers

Joe

---

From: "Murphy, Sandra" <[email-masked]>
Date: Tue, 1 Feb 2011 14:07:33 -0500

The draft draft-ietf-tsvwg-iana-ports-09 consolidates the procedures
scattered over several RFC for the assignment of service names and ports
for transport protocols.  It establishes definitions and specifications
where they were previously missing (like syntax for service names).  It
provides a single reference for assignment procedures going forward and
establishes procedures for port/name de-assignment, reuse, revocation,
etc., and a description of the required and optional fields that must be
provided in any request.

I did NOT review the referenced documents and did not therefore consider
differences between this procedure and previously employed procedures.

There is a required format for communication of a request to the IANA, I
presume by email.  I did not see any mention of the email address to
which the request should be sent (RFC5226 also doesn't seem to mention
it).

The procedure requires that the same previous Assignee (or Contact) make
any subsequent request about a port/name assignment, where the email
address is provided in the request.  Security question: how does the
IANA know that it is communicating with the same Assignee/Contact?
There's no recommendation for security of that communication.

 

--Sandy Murphy