Subject: [secdir] Security review of draft-hodges-webauthn-registries-05

From: "Hilarie Orman" <[email-masked]>
Date: Mon, 27 Apr 2020 22:41:49 -0600

Security review of Registries for Web Authentication
      	       draft-hodges-webauthn-registries-05

Do not be alarmed.  I generated this review of this document as part
of the security directorate's ongoing effort to review all IETF
documents being processed by the IESG.  These comments were written
with the intent of improving security requirements and considerations
in IETF drafts.  Comments not addressed in last call may be included
in AD reviews during the IESG review.  Document editors and WG chairs
should treat these comments just like any other last call comments.

This document establishes two registries required for the W3C Web
Authentication system.  The registries are for the WebAuthn
Attestation Statement Format Identifier and the WebAuthn Extension
Identifier.

When submitted, these entries must be approved by an "expert" based on
the specification that defines the parameters of the entry.  This
includes "security considerations", which is good.  I don't quite see
how submission of a request for a new entry gets routed to an expert,
how experts come into being, etc., but I suppose that is a W3C
procedure.

A couple of nits.

This url is listed twice in the URIs:
https://www.iana.org/assignments/webauthn
but it does not exist.  I expected at least a TBD message, unless the
address itself is a placeholder.

In 2.1
"The Experts(s) MAY also designate attestation
   statement formats as proprietary if they lack complete
   specifications, and will assign a prefix indicating as such to the
   identifier."  
It is not clear what the format of that prefix is or how indicates
"as such".  Is that an indication that it is proprietary or (and?)
that it is incomplete?

Hilarie