Subject: [secdir] Assignments

From: Samuel Weiler <[email-masked]>
Date: Tue, 21 Aug 2012 11:13:11 -0400 (EDT)

For those who may have missed the announcement in Vancouver, I will 
soon be stepping down as secdir secretary.  Tero Kivinen has agreed to 
step into the role.  For the moment, we are both doing secretarial 
things, so please make use of the [email-masked] address to 
reach us.

-- Sam

Review instructions and related resources are at:
        http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

Catherine Meadows is next in the rotation.

For telechat 2012-08-30

Reviewer                 LC end     Draft
Rob Austein            T 2012-06-26 draft-ietf-bmwg-2544-as-05
Dave Cridland          T 2012-08-23 draft-ietf-armd-problem-statement-03
Shawn Emery            T 2012-08-24 draft-ietf-dnsop-rfc4641bis-12
Warren Kumari          T 2012-07-11 draft-ietf-oauth-v2-threatmodel-07
Chris Lonvick          T 2012-08-27 draft-ietf-v6ops-wireline-incremental-ipv6-05
Alexey Melnikov        T -          draft-ietf-krb-wg-kdc-model-14
Tim Polk               T 2012-07-23 draft-ietf-appsawg-http-forwarded-07
Ondrej Sury            T 2012-08-13 draft-sparks-genarea-mailarch-05
Sam Weiler             T -          draft-ietf-nea-pt-tls-07
Nico Williams          T 2012-08-14 draft-ietf-ippm-testplan-rfc2679-02

For telechat 2012-09-13

Alexey Melnikov        T 2012-08-13 draft-ietf-storm-iscsi-cons-06

Last calls and special requests:

Dave Cridland            2012-06-28 draft-ietf-nfsv4-federated-fs-admin-11
Alan DeKok               2012-08-23 draft-ietf-mmusic-media-loopback-22
Donald Eastlake          2012-08-24 draft-ietf-pce-hierarchy-fwk-04
Phillip Hallam-Baker     2012-09-03 draft-kumaki-murai-l3vpn-rsvp-te-06
Jeffrey Hutzelman        -          draft-ietf-drinks-spp-protocol-over-soap-02
Leif Johansson           2012-08-29 draft-ietf-ccamp-assoc-ext-04
Charlie Kaufman          2012-08-29 draft-ietf-eai-mailinglistbis-05
Scott Kelly              -          draft-ietf-httpbis-p5-range-20
Stephen Kent             -          draft-ietf-httpbis-p7-auth-20
Tero Kivinen             -          draft-ietf-httpbis-p6-cache-20
Warren Kumari            2012-09-03 draft-ietf-mpls-entropy-label-05
Julien Laganier          2012-08-29 draft-ietf-sieve-imap-sieve-06
Eric Rescorla            2012-07-25 draft-ietf-websec-strict-transport-sec-12
Tom Yu                   2012-08-22 draft-ietf-manet-olsrv2-15
Glen Zorn                2012-06-27 draft-hoffman-tao4677bis-16
Glen Zorn                2012-08-14 draft-ietf-mptcp-api-05

---

From: Stephen Kent <[email-masked]>
Date: Fri, 24 Aug 2012 00:57:35 -0400

I reviewed this document as part of the security directorate's ongoing 
effort to review all IETF documents being processed by the IESG.These 
comments were written primarily for the benefit of the security area 
directors.Document editors and WG chairs should treat these comments 
just like any other last call comments.

This is a fairly brief document: 18 pages including appendices. The 
Abstract says that this document "...defines the HTTP Authentication 
framework" but the Introduction expands the description, saying that it 
" describes HTTP/1.1 access control and authentication." I suggest the 
introduction be changed to match the abstract, especially since the 
principal focus of the document is authentication. There are several 
places where the term "authorization" is used. In many contexts, this 
term is a synonym for access control. However, in this context it seems 
to be used almost interchangeably with "authentication" in most places. 
I suspect the terminology choice arises for historical reasons, but it 
might be helpful to explicitly note this, where applicable.

The introduction says that it includes "the relevant parts of RFC 2616 
with only minor changes ([RFC2616]), plus the general framework for HTTP 
authentication, as previously defined in "HTTP Authentication: Basic and 
Digest Access Authentication" ([RFC2617])." The document updates RFC 
2617, and obsoletes RFC 2616. It includes an appendix that describes the 
differences between this document and (the relevant portions) of 2616 
and 2617.

I'm not sure whether the use of lowercase "ought" in four places in 
Section 2.3.1 is intended to express a new level of IETF standards 
compliance, perhaps filling the gap between MAY and SHOULD ;-) .

I like the fact that the Security Considerations section addresses 
implementation issues, since the document, overall, addresses security. 
Only two topics are discussed here, but both seem relevant. I am 
surprised that there is no mention of using HTTPS, to protect the most 
commonly used credentials, i.e., passwords.