Subject: [secdir] SecDir review of draft-ietf-ecrit-car-crash-20

From: "Xialiang (Frank)" <[email-masked]>
Date: Thu, 5 Jan 2017 03:36:35 +0000

Hello,
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document describes how to use IP-based emergency services mechanisms to support the next generation of emergency calls placed by vehicles and conveying vehicle, sensor, and location data related to the crash or incident. Comparing to the ECRIT basic drafts [draft-ietf-ecrit-ecall] [RFC7852], this extension draft mostly reuses the same technical aspects of the basic drafts, with the introduction of some new things: a new set of vehicle (crash) data -- the Vehicle Emergency Data Set (VEDS), new attribute values to the metadata/control object, a new SIP INFO package of the VEDS MIME type, etc.

Since most technical aspects of this draft are unchanged from the basic drafts, all the security considerations in them apply for this draft well. The security consideration in [RFC5069] applies for this draft too. And these basic drafts already have very comprehensive and detailed considerations about privacy and security threats. Regarding the new introduced data and action values, this draft discusses the general security mechanisms to protect their CIA (e.g., certificate, encryption, ...) too. In Summary, I have no more security issues.

Summary: this document appears in reasonably good shape, and is written well. I think it is ready.

Thanks!
B.R.
Frank

---

From: Randall Gellens <[email-masked]>
Date: Thu, 5 Jan 2017 11:12:23 -0800

Hi Frank,

Thank you for your review.

--Randy

At 3:36 AM +0000 1/5/17, Xialiang (Frank) wrote:

>  Hello,
>  I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should 
> treat these comments just like any other last call comments.
>
>  This document describes how to use IP-based emergency services 
> mechanisms to support the next generation of emergency calls placed 
> by vehicles and conveying vehicle, sensor, and location data 
> related to the crash or incident. Comparing to the ECRIT basic 
> drafts [draft-ietf-ecrit-ecall] [RFC7852], this extension draft 
> mostly reuses the same technical aspects of the basic drafts, with 
> the introduction of some new things: a new set of vehicle (crash) 
> data -- the Vehicle Emergency Data Set (VEDS), new attribute values 
> to the metadata/control object, a new SIP INFO package of the VEDS 
> MIME type, etc.
>
>  Since most technical aspects of this draft are unchanged from the 
> basic drafts, all the security considerations in them apply for 
> this draft well. The security consideration in [RFC5069] applies 
> for this draft too. And these basic drafts already have very 
> comprehensive and detailed considerations about privacy and 
> security threats. Regarding the new introduced data and action 
> values, this draft discusses the general security mechanisms to 
> protect their CIA (e.g., certificate, encryption, ...) too. In 
> Summary, I have no more security issues.
>

-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
If you would look up bad labor relations in the dictionary, you
would have an American Airlines logo beside it.
    --U.S. District Judge Joe Kendall, issuing a restraining order
against an American Airlines APA pilot union sick out, 10 Feb 1999.