Subject: [secdir] secdir review of draft-ietf-precis-mappings-11

From: "Scott G. Kelly" <[email-masked]>
Date: Mon, 3 Aug 2015 23:06:47 -0700 (PDT)

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

The case and width mappings defined in the current PRECIS (Preparation, Enforcement, and Comparison of Internationalized Strings) framework do not handle other mappings (such as delimiter characters, special characters, and locale-dependent or context-dependent case). This short document aims to provide mapping guidelines for PRECIS profile designers.

I think this document is probably ready, but I would raise one question (below) for consideration of those more knowledgeable in this area.

I think the primary security issue with these mappings is that users may misinterpret them (e.g. see "IDN homograph attack" on wikipedia). The security considerations in this document says

   As with Mapping Characters for IDNA2008 [RFC5895], this document
   suggests creating mappings that might cause confusion for some users
   while alleviating confusion in other users.  Such confusion is not
   covered in any depth in this document.

This seems a little terse, but it turns out that it matches the security considerations section of RFC5895 nearly word for word.

My question: should this also include a reference to the security considerations in RFC7564? I leave this to those who know more about 5895, 7564, and PRECIS.

--Scott

---

From: Takahiro Nemoto <[email-masked]>
Date: Fri, 7 Aug 2015 11:14:23 +0900

Dear Mr. Scott:

Thank you for taking your time to review draft-ietf-precis-mappings-11.
We will add a reference to RFC7564 and modify the section 4 "Security Considerations" as following.

4.  Security Considerations

  Detailed security considerations for PRECIS strings are discussed 
  in the PRECIS framework specification [RFC7564].  This document 
  inherits the considerations as well.

Regards,

--
Takahiro Nemoto
[email-masked]

> 2015/08/04 15:06、Scott G. Kelly <[email-masked]> のメール：
>