Subject: [secdir] Security review of draft-ietf-tls-multiple-cert-status-extension-04

From: "Hilarie Orman" <[email-masked]>
Date: Fri, 29 Mar 2013 14:34:55 -0600

Security review of draft-ietf-tls-multiple-cert-status-extension-04

Do not be alarmed.  I have reviewed this document as part of the
security directorate's ongoing effort to review all IETF documents
being processed by the IESG.  These comments were written primarily
for the benefit of the security area directors.  Document editors and
WG chairs should treat these comments just like any other last call
comments.

The final paragraph in section 2.2 discusses using an unauthenticated
session for the purpose of obtaining certificates in order to
authenticate the session.  Sending usernames and passwords over the
connection while unauthenticated is regarded as "inappropriate".  This
seems to be a serious problem, deserving of at least a "MUST NOT".

In section 2.2, "A server that receive a client hello" should be
"A server that receives a client hello".  Later,
"require trust in the server, and the server certificate has not been"
reads better without the comma.

Hilarie

---

From: "Yngve N. Pettersen" <[email-masked]>
Date: Fri, 29 Mar 2013 22:29:53 +0100

Hello Hilarie,

Thanks for the review.

> seems to be a serious problem, deserving of at least a "MUST NOT".

I changed that to:

  "In this case, the client could continue with the handshake, but it MUST  
NOT disclose a username and password until it has fully validated the  
server certificate."

It will be included in the -06 version. I'll probably wait until next week  
with that one, since I released -05 earlier today.

> "A server that receives a client hello".  Later,

This has already been fixed in the -05 version.

> reads better without the comma.

I am not sure about this one. The original version was without the comma,  
but I asked a former colleague (a document writer/reviewer) to review that  
update, and she suggested the comma.

-- 
Sincerely,
Yngve N. Pettersen

Using Opera's mail client: http://www.opera.com/mail/