Subject: [secdir] Secdir last call review of draft-ietf-cellar-ffv1-16

From: Liang Xia via Datatracker <[email-masked]>
Date: Tue, 21 Jul 2020 17:30:25 -0700

Reviewer: Liang Xia
Review result: Ready

I have carried out the SecDir review for the -02 version, and all my nit
concerns are addressed in current -16 version.

But about my one question, I have not seen any response or actions: "Issues for
clarification: In Security Considerations, besides the DoS attacks brought by
the malicious payloads, is there any other kinds of attack possibly? For
example, virus or worm are hidden in the malicious payloads to attack the
system for more damages? Does it make sense and what's the consideration?"

This time, is there any clarification?
Thanks!

---

From: Michael Richardson <[email-masked]>
Date: Thu, 23 Jul 2020 13:50:09 -0400

> system for more damages? Does it make sense and what's the consideration?"

Hi, thank you for the review comments.
Aside from possible buffer-overflow attacks that would attempt to smash the
stack of a process, none of the content carried in ffv1 is intended to be executable.

A virus or worm hidden in the payload would be rendered as if it was visual
data by normal software processing.

Clearly, a malicious system could use the ffv1 format in an attempt to disquise
itself, but that would take a co-consipirator to extract that content.

--
Michael Richardson <[email-masked]>, Sandelman Software Works
 -= IPv6 IoT consulting =-