Subject: [secdir] Secdir Review of draft-ietf-hip-rfc5205-bis-08

From: Tina TSOU <[email-masked]>
Date: Mon, 4 Jan 2016 18:29:59 +0000

Dear all,

Happy New Year 2016!

I have reviewed this document as part of the security directorate’s ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area
directors. Document editors and WG chairs should treat these comments just like any other last call comments.

** Technical **

* Section 8:

You refer to IPSECKEY RR [RFC4025] to note some of the possible threats
for HIP RRs. I think you should spell these out, and discuss them
explicitly.

** Editorial **

* Section 3, page 4:
>  In the following, we assume that the Initiator first queries for HIP
>  resource records at the Responder FQDN.

s/at/for/

* Section 3, page 4:
> and further queries for the same owner name SHOULD NOT be
>  made.

What's an "owner name"? Maybe this should be "domain name", instead?

* Section 3, page 5:
>  Note that storing HIP RR information in the DNS at an FQDN that is
>  assigned to a non-HIP node might have ill effects on its reachability
>  by HIP nodes.

s/a/an/

* Section 4.2, page 9:
> The RVS
>  information may be copied and aligned across multiple RRs, or may be
>  different for each one; a host MUST check that the RVS used is
>  associated with the HI being used, when multiple choices are
>  present."

There's no matching quote sign for this one.

Thank you,
Tina

---

From: Julien Laganier <[email-masked]>
Date: Sun, 31 Jan 2016 16:31:06 -0800

Tina,

Happy new year, and thank you for reviewing the draft. My apologies
for the belated reply. Please find my answers to your comments inlined
below:

On Mon, Jan 4, 2016 at 10:29 AM, Tina TSOU <[email-masked]> wrote:
[...]
> for HIP RRs. I think you should spell these out, and discuss them

The intent was to provide an informative statement regarding the broad
similarity between threats applying to the IPSECKEY RR and threats
applying to the HIP RR. The remainder of the section does explicitly
discuss the threats pertaining to the HIP RR. I have clarified the
text such that the intent is communicated more clearly:

   In a manner similar to the IPSECKEY RR [RFC4025], the HIP DNS
   Extension allows for the provision of two HIP nodes with the public
   keying material (HI) of their peer.  These HIs will be subsequently
   used in a key exchange between the peers.  Hence, the HIP DNS
   Extension is subject, as the IPSECKEY RR, to threats stemming from
   attacks against unsecured HIP RRs, as described in the remainder of
   this section.

>>  resource records at the Responder FQDN.

The use of "at" is consistent with the language found in RFC1035, e.g.:

   The first step a resolver takes is to transform the client's request,
   stated in a format suitable to the local OS, into a search specification
   for RRs _at_ a specific name which match a specific QTYPE and QCLASS.

Thus I believe no change need to be made.
> What's an "owner name"? Maybe this should be "domain name", instead?

As per RFC1035, a DNS RR is defined as containing a NAME which is
defined as "an owner name, i.e., the name of the node to which this
resource record pertains.", thus I believe no change need to be made.

>>  assigned to a non-HIP node might have ill effects on its reachability

If you're referring to the "a" in "a non-HIP node", I believe that
this is the correct spelling since the "non" syllable begins with a
consonant onset "n".

> There's no matching quote sign for this one.

Good catch. I fixed that.

Thanks again for the review, and best regards.

--julien