Subject: Re: [secdir] Secdir last call review of draft-ietf-capport-rfc7710bis-04

From: Benjamin Kaduk <[email-masked]>
Date: Sat, 13 Jun 2020 22:12:50 -0700

Hi Rifaat,

Thanks for the review and extended discussion with the authors/shepherd/AD.
I made some comments continuing in a similar line of reasoning, seeking to
clarify what is expected to be user-facing and how the chain of trust is
established.  (I also filed a Discuss point about an apparent internal
inconsistency on whether the API URLs distributed by different mechanisms
must be "identical" or merely "equivalent".)

Thanks again,

Ben

On Fri, May 01, 2020 at 05:10:19AM -0700, Rifaat Shekh-Yusef via Datatracker wrote:
> Reviewer: Rifaat Shekh-Yusef
> Review result: Has Issues
> 
> Since the use of IP address literal is not forbidden by this document, what if 
> an attacker with the ability to inject DHCP messages or RAs uses this option 
> to force the user to contact an IP address of his choosing? In this case, the use 
> of TLS and presenting the identity in the certificate might not be of much help.
> 
> I think this case should be discussed in the security consideration section.
> 
> 
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview