Subject: [secdir] Secdir review of draft-hakala-urn-nbn-rfc3188bis-00

From: Vincent Roca <[email-masked]>
Date: Fri, 25 May 2018 16:23:52 +0200

Hello,

I have reviewed this document as part of the security directorate’s ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

Summary: Ready with nits

This document specifies the use of National Bibliography Numbers (NBN)s as a particular URN namespace.
The authors explain that "no specific security threats have been identified for NBN-based URNs".
The authors also explain that, since this document specifies high level concepts, several security aspects are out of scope.
I tend to agree with the authors, although I don't know the domain.

Otherwise a few general comments:

ABNF compliance:

* Section 5: please check the ABNF compliance, for instance using Bill's ABNF Parser, https://tools.ietf.org/tools/bap/abnf.cgi
I guess you mean:
        nbn_string  = <specific per prefix>
rather than:
        nbn_string  = &lt;specific per prefix&gt;
The checker also complains with rule names (Illegal character '_').

Typos:

* Introduction: remove "to" in "must to have a namespace of its own" (or do you mean "too"?).

* Introduction: rather than "ISSN (International Serial Standard Number)", it seems (wikipedia) that the acronym stands for "International Standard Serial Number".

Regards,

   Vincent

---

From: Peter Saint-Andre <[email-masked]>
Date: Tue, 29 May 2018 10:09:26 -0600

Hi Vincent, thanks for your review. I'm the document shepherd and the
author is on holiday right now, so I'll reply on a few points.

On 5/25/18 8:23 AM, Vincent Roca wrote:
> Summary: *Ready with nits*
> 
> 
> The authors also explain that, since this document specifies high level
> concepts, several security aspects are out of scope.

Would you like to see a bit more explanatory text on these matters?

> * Section 5: please check the ABNF compliance, for instance using Bill's
> ABNF Parser, https://tools.ietf.org/tools/bap/abnf.cgi
> I guess you mean:

This has been noted and will be fixed in -01, see here:

https://www.ietf.org/mail-archive/web/urn/current/msg03891.html

> * Introduction: rather than "ISSN (International Serial Standard
> Number)", it seems (wikipedia) that the acronym stands for
> "International Standard Serial Number".

Thanks for the review!

Peter

---

From: Vincent Roca <[email-masked]>
Date: Thu, 31 May 2018 10:02:47 +0200

Hello Peter,

> author is on holiday right now, so I'll reply on a few points.

[..]

> Would you like to see a bit more explanatory text on these matters?

More explanatory text is always welcome, but as I said, I wouldn’t
object if the doc stays as is.

> Thanks for the review!

You’re welcome.

  Vincent