Subject: [secdir] sec-dir review of draft-ietf-bliss-call-completion-18

From: Derek Atkins <[email-masked]>
Date: Mon, 17 Dec 2012 10:54:54 -0500

Hi,

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

   The call completion feature defined in this specification allows the
   caller of a failed call to be notified when the callee becomes
   available to receive a call.

The Security Considerations section mentions 'SPIT' but nowhere does
the document define the term.  What does it mean?

The SC section also mentions a "DoD" attack -- is the US Department of
Defence actually going to attack something?  Or does DoD mean
something else?  It's never defined.  Was this perhaps a typo of
"DoS", Denial of Service?  If so, I recommend you fix the typo but
also expand the acronym for those not necessarily familiar with the
term "DoS".

-derek

-- 
       Derek Atkins                 617-623-3745
       [email-masked]             www.ihtfp.com
       Computer and Internet Security Consultant

---

From: <[email-masked]>
Date: Wed, 19 Dec 2012 10:43:33 +0100

Hi Derek,

thanks for the review.

'SPIT' is an acronym for 'Spam over Internet Telephony', which Wikipedia defines as 'bulk unsolicited, automatically dialled, pre-recorded phone calls using the Voice over Internet Protocol (VoIP)'. (http://en.wikipedia.org/wiki/VoIP_spam)

We will add a proper definition for SPIT.

For the DoD attack: 'DoD' actually does mean 'Department of Defence', the authors of the draft have received information that the Department of Defence plans to attack something, but because of secrecy reasons we cannot give more information at this time.

;-)

Joking apart, yes, this is a typo of 'DoS' (Denial of Service), a proper definition will be added.

Thanks for your support.

Regards, Martin

> -----Ursprüngliche Nachricht-----
> Von: Derek Atkins [mailto:[email-masked]]
> Gesendet: Montag, 17. Dezember 2012 16:55
> An: [email-masked]; [email-masked]
> Cc: [email-masked]; [email-masked];
> Hülsemann, Martin; Jesske, Roland; [email-masked]
> Betreff: sec-dir review of draft-ietf-bliss-call-completion-18
>
> Hi,
>
> I have reviewed this document as part of the security
> directorate's ongoing effort to review all IETF documents
> being processed by the IESG.  These comments were written
> primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments
> just like any other last call comments.
>
> The Security Considerations section mentions 'SPIT' but
> nowhere does the document define the term.  What does it mean?
>
> The SC section also mentions a "DoD" attack -- is the US
> Department of Defence actually going to attack something?  Or
> does DoD mean something else?  It's never defined.  Was this
> perhaps a typo of "DoS", Denial of Service?  If so, I
> recommend you fix the typo but also expand the acronym for
> those not necessarily familiar with the term "DoS".
>
> -derek
>
> --

---

From: Robert Sparks <[email-masked]>
Date: Wed, 19 Dec 2012 10:30:17 -0600

> We will add a proper definition for SPIT.
Defining the term in place is sufficient. If you decide you need a 
reference, consider RFC5039
("The Session Initiation Protocol (SIP) and Spam").

RjS

---

From: Derek Atkins <[email-masked]>
Date: Wed, 19 Dec 2012 12:25:32 -0500

> We will add a proper definition for SPIT.

I don't think you necessarily need a proper definition.  Just expanding
the acronym in-place would be sufficient.  E.g., "Spam over Internet
Telephony (SPIT)"

> For the DoD attack: 'DoD' actually does mean 'Department of Defence', the authors of the draft have received information that the Department of Defence plans to attack something, but because of sec…

:-)

> Joking apart, yes, this is a typo of 'DoS' (Denial of Service), a proper definition will be added.

Again, no need to add a definition, just expand in-place:  "Denial of
Service (DoS)"

> Regards, Martin

Thanks!

-derek