Subject: [secdir] Review of draft-ietf-repute-query-http-09

From: Shawn M Emery <[email-masked]>
Date: Wed, 21 Aug 2013 22:00:53 -0600

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This internet-draft describes a protocol for querying reputation data
via HTTP.  The first part of the protocol retrieves a template that will subsequently
be used as the basis for a URI, which in turn is used to retrieve the reputation
information.

The security considerations section does exist and acknowledges that the base
protocol for retrieving URIs is insecure as well as the retrieval of reputation
data.  The section refers to the URI template and well-known URI RFCs for further
discussions of template exchange security issues and makes an informative reference
to the repute considerations draft for the reputation retrieval.  However, none of the
referenced RFCs and draft directly talk about the various attacks and how to mitigate
against said attacks.  I would suggest a direct reference if such a document exists.

General comments:

None.

Editorial comments:

s/comprise the/comprise of the/

s/explicitly support support/explicitly support/

s/until finds one/until the client finds one/

Shawn.
--

---

From: Shawn M Emery <[email-masked]>
Date: Sat, 24 Aug 2013 22:56:35 -0600

On 08/21/13 10:22 PM, Dave Crocker wrote:
> On 8/21/2013 9:00 PM, Shawn M Emery wrote:
>> However, none of the
>> referenced RFCs and draft directly talk about the various attacks and
>> how to mitigate against said attacks.
>
>
> Shawn, some clarification please:
>
>    This is a simple query protocol, ableit yes one where the data is
> making trust assertions.
>
>    A possible implication of your above comment is that all IETF
> protocols should carry a threat analysis.  Have I misunderstood?

Hi Dave,

Sorry for not being specific.  I will try to clarify my concerns:

This draft references the reputation considerations draft when providing 
or using reputation services, I assume in a security context given that 
it is referenced in the security considerations section.  When I looked 
at the referenced draft's security considerations section it stated that 
there are threats discussed in the operation text above.  I think that 
these types of discussions deserve a separate section.  If the topic is 
mostly security it would be helpful to have a summary of the various 
threats and how to mitigate.  In any case, when looking through the 
entire draft I do see some suggestions for clients and their RSPs.

Shawn.
--

---

From: Uri Blumenthal <[email-masked]>
Date: Sun, 25 Aug 2013 06:38:20 -0400

And if every protocol description did carry a threat analysis, IMHO it would be a GOOD thing. 

Sent from my iPad

On Aug 25, 2013, at 0:56, Shawn M Emery <[email-masked]> wrote:

> This draft references the reputation considerations draft when providing or using reputation services, I assume in a security context given that it is referenced in the security considerations section.  When I looked at the referenced draft's security considerations section it stated that there are threats discussed in the operation text above.  I think that these types of discussions deserve a separate section.  If the topic is mostly security it would be helpful to have a summary of the various threats and how to mitigate.  In any case, when looking through the entire draft I do see some suggestions for clients and their RSPs.
> 
> Shawn.
> --
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

---

From: Dave Crocker <[email-masked]>
Date: Wed, 21 Aug 2013 21:22:18 -0700

d/

-- 
Dave Crocker
Brandenburg InternetWorking
bbiw.net

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Mon, 26 Aug 2013 22:10:37 -0700

Hi Shawn, thanks for the review.

On Sat, Aug 24, 2013 at 9:56 PM, Shawn M Emery <[email-masked]>wrote:

> or using reputation services, I assume in a security context given that it
> is referenced in the security considerations section.  When I looked at the
> referenced draft's security considerations section it stated that there are
> threats discussed in the operation text above.  I think that these types of
> discussions deserve a separate section.  If the topic is mostly security it
> would be helpful to have a summary of the various threats and how to
> mitigate.  In any case, when looking through the entire draft I do see some
> suggestions for clients and their RSPs.
>
>
>
I'm still a little unclear about what the suggestion is here.  Since this
review is specific to query-http, I take your feedback to mean that
query-http itself is fine, but it's desirable that the considerations
document go into more detail about what it's discussing.  I think that's
fine and probably true, and I'll do so for that document, but I don't think
there's anything outstanding for this one.  Do you agree?

-MSK

---

From: Shawn M Emery <[email-masked]>
Date: Tue, 27 Aug 2013 23:21:28 -0600

On 08/26/13 11:10 PM, Murray S. Kucherawy wrote:
> On Sat, Aug 24, 2013 at 9:56 PM, Shawn M Emery <[email-masked] 
> <mailto:[email-masked]>> wrote:
>
>     This draft references the reputation considerations draft when
>     providing or using reputation services, I assume in a security
>     context given that it is referenced in the security considerations
>     section.  When I looked at the referenced draft's security
>     considerations section it stated that there are threats discussed
>     in the operation text above.  I think that these types of
>     discussions deserve a separate section.  If the topic is mostly
>     security it would be helpful to have a summary of the various
>     threats and how to mitigate.  In any case, when looking through
>     the entire draft I do see some suggestions for clients and their RSPs.
>
>
>
> I'm still a little unclear about what the suggestion is here.  Since 
> this review is specific to query-http, I take your feedback to mean 
> that query-http itself is fine, but it's desirable that the 
> considerations document go into more detail about what it's 
> discussing.  I think that's fine and probably true, and I'll do so for 
> that document, but I don't think there's anything outstanding for this 
> one.  Do you agree?

Yes, that's pretty much it; that this draft or the referenced draft 
should have a consolidated list of the various security issues and 
guidance to counter them.

Thanks,

Shawn.
--