Subject: [secdir] Secdir review of draft-ietf-nfsv4-rfc3530bis-dot-x-16

From: Magnus Nyström <[email-masked]>
Date: Sun, 14 Apr 2013 23:22:53 -0700

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just
like any other last call comments.

This NFSv4.0 document provides the XDR definition for NFSv4.0. As such,
except for the introductory section and standard sections towards the end,
it consists entirely of extractable, machine-readable declarations and
definitions.

The Security Considerations section simply refers to the rfc2530bis main
document. This may be sufficient; however, if the NFSv4.0 XDR definition
introduces any new parsing risks (for example, anything related to
internationalization?), then it may be better placed in this document.
-- Magnus

---

From: "Haynes, Tom" <[email-masked]>
Date: Wed, 17 Apr 2013 00:16:08 +0000

On Apr 14, 2013, at 11:22 PM, Magnus Nyström <[email-masked]<mailto:[email-masked]>> wrote:

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

This NFSv4.0 document provides the XDR definition for NFSv4.0. As such, except for the introductory section and standard sections towards the end, it consists entirely of extractable, machine-readable declarations and definitions.

The Security Considerations section simply refers to the rfc2530bis main document. This may be sufficient; however, if the NFSv4.0 XDR definition introduces any new parsing risks (for example, anything related to internationalization?), then it may be better placed in this document.

-- Magnus

Hi Magnus,

That simply becomes too unwieldily.

We have another example of this, RFC 5661 and 5662. I always look at RFC 5661 and I rarely look at RFC 5662.

My expectation is that this is the way others work.

I would prefer to leave the internationalization work back in the main document.

Thanks,
Tom

---

From: Magnus Nyström <[email-masked]>
Date: Tue, 16 Apr 2013 17:29:14 -0700

Hi Tom, lest there be any misunderstanding: What I suggested was, that it
may make sense to discuss how internationalization aspects as they pertain
to the XDR itself may impact security in this document's security
consideration section. If the main 2530bis document already discusses
internationalization aspects covering also XDR aspects then I don't see a
strong need to add it to this one.
Thanks,
/M

On Tue, Apr 16, 2013 at 5:16 PM, Haynes, Tom <[email-masked]> wrote:

>
>  On Apr 14, 2013, at 11:22 PM, Magnus Nyström <[email-masked]> wrote:
>
>  I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
>  These comments were written primarily for the benefit of the security area

-- 
-- Magnus