Subject: [secdir] secdir review of draft-ietf-calext-extensions-03

From: "Xialiang (Frank)" <[email-masked]>
Date: Wed, 22 Jun 2016 01:39:06 +0000

Hello,

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document defines a set of new properties for iCalendar data as well as extending the use of some existing properties to the entire iCalendar object.

In general, since this document just defines several new properties and extends some existing properties with new parameters for the iCalendar object, there are limited new threats brought by this work which are covered in the "Security Considerations" section.

Summary: this document appears in reasonably good shape, with minor issues that should be addressed before publication.

Below is a series of my comments, nits for your consideration.

comments:
section 7
1. This section covers the possible new threats brought by new properties and parameters, but does not mention how to mitigate them explicitly. Could you consider this point?
2. The "Security Considerations" section of [RFC5545] describes the general security issues and its corresponding relation with the transport protocol. It's clear and comprehensive. As the extension draft to the iCalendar object specification, it's a good practice to mention that the security considerations in [RFC5545] continue to apply in this document.

section 5.2--5.6
These sections specify the extensive properties, and don't follow the template in [RFC5545]. Would it be better to have some text for each extensive property to point out its original specification in [RFC5545] for easy understanding?

section 5.11
The new property -- conference, is missed in the previous iCalendar components' definition in section 4;

nits:
Section 8.1
The section number of [RFC5545] referenced here is wrong, it should be modified from 8.2.3 to 8.3.2;

Section 8.2
The section number of [RFC5545] referenced here is wrong, it should be modified from 8.2.4 to 8.3.3;

Thanks!

B.R.
Frank

---

From: Cyrus Daboo <[email-masked]>
Date: Wed, 22 Jun 2016 13:07:20 -0400

Hi Xialiang,
Thank you for your review. Fixes described below have been made to my 
working copy and will be included in the next published draft.

--On June 22, 2016 at 1:39:06 AM +0000 "Xialiang (Frank)" 
<[email-masked]> wrote:

> 1. This section covers the possible new threats brought by new properties
> and parameters, but does not mention how to mitigate them explicitly.
> Could you consider this point?

I've added some additional text to my working copy to cover that.

> 2. The "Security Considerations" section
> of [RFC5545] describes the general security issues and its corresponding
> relation with the transport protocol. It's clear and comprehensive. As
> the extension draft to the iCalendar object specification, it's a good
> practice to mention that the security considerations in [RFC5545]
> continue to apply in this document.

I have added the follow text as the last paragraph of Security 
Considerations:

    Security considerations in [RFC5545], and [RFC5546] MUST also be
    adhered to.

I have also added a Privacy Considerations section with similar text.

Also, on further review there were a couple of addition items I felt needed 
to be added to these sections. In particular text about short 
REFRESH-INTERVALs being used to trigger denial of service attacks.

> section 5.2--5.6
> These sections specify the extensive properties, and don't follow the
> template in [RFC5545]. Would it be better to have some text for each
> extensive property to point out its original specification in [RFC5545]
> for easy understanding?

OK. I have added text in each of those sections providing a reference back 
to the section in RFC5545 where the original definitions reside.

> components' definition in section 4;

Fixed.

> modified from 8.2.4 to 8.3.3;

Fixed.

-- 
Cyrus Daboo

---

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 23 Jun 2016 02:35:53 +0000

Great, thank you.

-----邮件原件-----
发件人: Cyrus Daboo [mailto:[email-masked]] 
发送时间: 2016年6月23日 1:07
收件人: Xialiang (Frank); [email-masked]'; [email-masked]'; [email-masked]
主题: Re: secdir review of draft-ietf-calext-extensions-03

Hi Xialiang,
Thank you for your review. Fixes described below have been made to my working copy and will be included in the next published draft.

--On June 22, 2016 at 1:39:06 AM +0000 "Xialiang (Frank)" 
<[email-masked]> wrote:

> 1. This section covers the possible new threats brought by new 
> properties and parameters, but does not mention how to mitigate them explicitly.

> 2. The "Security Considerations" section of [RFC5545] describes the 
> general security issues and its corresponding relation with the 
> transport protocol. It's clear and comprehensive. As the extension 
> draft to the iCalendar object specification, it's a good practice to 
> mention that the security considerations in [RFC5545] continue to 
> apply in this document.

Also, on further review there were a couple of addition items I felt needed to be added to these sections. In particular text about short REFRESH-INTERVALs being used to trigger denial of service attacks.

> extensive property to point out its original specification in 
> [RFC5545] for easy understanding?

OK. I have added text in each of those sections providing a reference back to the section in RFC5545 where the original definitions reside.

Fixed.

Fixed.

--
Cyrus Daboo