Subject: [secdir] secdir review of draft-ietf-geojson-03

From: Melinda Shore <[email-masked]>
Date: Wed, 25 May 2016 22:15:07 -0800

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

(note: I was assigned the -02 revision of the document, but the -03
version was just issued and I am reviewing that).

Summary: this document is ready, with minor issues

This document describes a JSON format for representing geospatial
data.  It recommends a single coordinate reference system and does
not appear to be readily extensible to other coordinate reference
systems, but I'll assume that this has been addressed and resolved
by the responsible AD, etc. if it's actually a problem.

The security considerations section is brief and refers the reader
to the core JSON specification.  The second paragraph of the
security considerations sections may have minor issues in that it
says "if sensitive data requires privacy or integrity protection the
service must be provided externally."  It may be appropriate, and
provide additional clarity, to distinguish between protection of
data in flight and data at rest (the IETF does not typically deal
with protection of the latter).  It may be sufficient to make the
word "externally" go away and replace it with something more specific -
for example,
     "if sensitive data require privacy or integrity protection
     those must be provided by the transport, for example TLS or
     HTTPS."

Otherwise, looks ready.

Melinda

---

From: Tim Schaub <[email-masked]>
Date: Thu, 26 May 2016 09:11:49 -0600

Thanks for the feedback Melinda.  I put together a pull request with
your proposed changes:
https://github.com/geojson/draft-geojson/pull/205

Tim

---

From: Melinda Shore <[email-masked]>
Date: Thu, 26 May 2016 10:05:45 -0800

> https://github.com/geojson/draft-geojson/pull/205

Cool, thanks.  If text regarding data at rest is wanted
it may be sufficient to say something along the lines of
"There will be cases in which stored data need protection,
which is out of scope for this document."

Melinda

---

From: Martin Thomson <[email-masked]>
Date: Fri, 27 May 2016 17:05:02 +1000

> by the responsible AD, etc. if it's actually a problem.

This was discussed - extensively - by the working group.  The lack of
specific extensions for CRS is a deliberate decision.

---

From: Tim Schaub <[email-masked]>
Date: Sat, 28 May 2016 16:15:26 -0600

> which is out of scope for this document."

Sounds good.

I've updated the pull request so the Security Considerations text now
finishes with this:

"If sensitive data requires privacy or integrity protection, those
must be provided by the transport — for example TLS or HTTPS. There
will be cases in which stored data need protection, which is out of
scope for this document."

https://circle-artifacts.com/gh/geojson/draft-geojson/141/artifacts/0/home/ubuntu/draft-geojson/draft.html#rfc.section.10