Subject: [secdir] Secdir review of draft-johansson-loa-registry-04

From: Vincent Roca <[email-masked]>
Date: Tue, 3 Apr 2012 11:18:29 +0200

Hello,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.

I have two comments WRT to section 7: 

1/ It is said:
  "An implementor of MUST NOT treat the registry as a trust framework or
  federation [...]"

As I understand the IANA registry is a record of LOA definitions that are
part of a trust framework. So that's a different concept, I agree. But why
is this sentence in the "Security Considerations" section? It could be moved
to section 3 for instance.

2/ The rest of the sentence is confusing IMHO:
  "An implementor [...] MUST NOT make any assumptions about the properties of
  any of the listed level of assurance URIs or their associated trust
  frameworks or federations based on their presense in the IANA registry."

Do you mean that the fact an IANA registry exists, by itself, does not garranty
the trust framework actually provides the expected security features (i.e. the
IANA registry is merely a definition record)?
I don't like the term "any assumption". If a LOA tells me I can achieve some
security level by using it, I'll first **assume** it's true and in a second step
I'll verify it's indeed the case.

Typos and general comments:

** section 7:            
- In the first sentence, something is missing:
       "An implementor of MUST NOT"
Of what?

- Later:
       "...based on their presense in the IANA registry"
Don't you mean presence (with a "c")?

** section 3.1: in the example, it is said:
                  "Defines Level 1 of FAF"
I didn't understand what FAF stands for. I think you'd better avoid using
an acronym here.

** section 3. There's a missing "." before "This" in:
  "URI:  A URI referencing a Level of Assurance Profile This is the
     registry key."

Regards,

Vincent

---

From: Leif Johansson <[email-masked]>
Date: Tue, 03 Apr 2012 12:32:15 +0200

On 04/03/2012 11:18 AM, Vincent Roca wrote:
> Hello,
> 
> I have reviewed this document as part of the security
> directorate's ongoing effort to review all IETF documents being
> processed by the IESG.  These comments were written primarily for
> the benefit of the security area directors. Document editors and WG
> chairs should treat these comments just like any other last call
> comments.
> 
> 1/ It is said: "An implementor of MUST NOT treat the registry as a
> trust framework or federation [...]"
> 
> As I understand the IANA registry is a record of LOA definitions
> that are part of a trust framework. So that's a different concept,
> I agree. But why is this sentence in the "Security Considerations"
> section? It could be moved to section 3 for instance.

I guess it could.

> 
> 2/ The rest of the sentence is confusing IMHO: "An implementor
> [...] MUST NOT make any assumptions about the properties of any of
> the listed level of assurance URIs or their associated trust 
> Do you mean that the fact an IANA registry exists, by itself, does
> not garranty the trust framework actually provides the expected
> security features (i.e. the IANA registry is merely a definition
> record)?

Yes thats the intent!

> I don't like the term "any assumption". If a LOA tells me I can
> achieve some security level by using it, I'll first **assume** it's
> true and in a second step I'll verify it's indeed the case.
> 

What I want to say is that the fact that the entry exists doesn't
imply any quality of the underlying trust framework.

> ** section 7: - In the first sentence, something is missing: "An
> implementor of MUST NOT" Of what?
> 

I got this from gen-art too. I'm changing it to ".. of software that
consumes the registry"

> - Later: "...based on their presense in the IANA registry" Don't
> you mean presence (with a "c")?
> 
> 
yup

> ** section 3.1: in the example, it is said: "Defines Level 1 of
> FAF" I didn't understand what FAF stands for. I think you'd better
> avoid using an acronym here.
> 

It was an attempt at humor - FAF is the Foo Assurance Framework.

> ** section 3. There's a missing "." before "This" in: "URI:  A URI
> referencing a Level of Assurance Profile This is the registry
> key."
> 

excellent, thx!

> Vincent

Thanks for a great review!

	Cheers Leif

---

From: Vincent Roca <[email-masked]>
Date: Wed, 4 Apr 2012 08:21:55 +0200

Hi Leif,

> imply any quality of the underlying trust framework.

So it's just a matter of presentation. I prefer your sentence ("does not imply any
quality...") to what is said in the I-D ("must not make any assumptions...").

> Thanks for a great review!

You're welcome.

Cheers,

   Vincent