Subject: [secdir] secdir review of draft-ietf-precis-7700bis-07

From: Daniel Migault <[email-masked]>
Date: Fri, 9 Jun 2017 13:04:55 -0400

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

The summary of the review is READY

nits:

COMMENT A)

"""
2.1.  Rules

   The following rules apply within the Nickname profile of the PRECIS
   FreeformClass.
"""

I might be helpful to add the reference to RFC7564 after the FreeformClass
as you did in section 2.2. Another way could also to assume in the
introduction the reader is familiar with RFC7564. I also agree RFC7564 is
mentioned in the terminology section.

COMMENT B)

"""
 4.  Normalization Rule: Apply Unicode Normalization Form KC.  Because
"""

Two unexpected white spaces. Can be fixed by rfc-editor

COMMENT C)

"""
6.  Security Considerations

6.3.  Visually Similar Characters
"""

Maybe a reference to the example section with the names 5/7 or 6/7 can
illustrate that the current profile does not prevent visually similar
characters.

---

From: Peter Saint-Andre - Filament <[email-masked]>
Date: Fri, 9 Jun 2017 14:08:33 -0600

Hi Daniel, thanks for the review. Comments inline.

On 6/9/17 11:04 AM, Daniel Migault wrote:
> I might be helpful to add the reference to RFC7564 after the
> FreeformClass as you did in section 2.2. Another way could also to
> assume in the introduction the reader is familiar with RFC7564. I also
> agree RFC7564 is mentioned in the terminology section.

It can't hurt to reference RFC 7564 here, too.

> illustrate that the current profile does not prevent visually similar

Well, those characters aren't visually similar. Section 12.5 of
rfc7546bis talks about this in detail; although it does provide some
examples, it might help to add more (e.g., CYRILLIC SMALL LETTER A
U+0430 vs. LATIN SMALL LETTER A U+0061).

Peter

-- 
Peter Saint-Andre
https://filament.com/
+1-720-256-6756

---

From: Daniel Migault <[email-masked]>
Date: Sat, 10 Jun 2017 01:10:10 +0000

Thanks for the response. It addresses my comment.  

My comment was motivated by re-using an example developed in the document to illustrate that mapping rules needs to be coordinated with the other security considerations. However, for some reasons, I missed that the capital letter of GREEK SMALL LETTER FINAL SIGMA and GREEK SMALL LETTER SIGMA are "similar" because it is the same Unicode character. I apology for the confusion.

I agree with you that the CYRILLIC SMALL LETTER A vs. LATIN SMALL LETTER A  example is not needed. 

Thanks for the response!

Yours, 

Daniel
-----Original Message-----
From: Peter Saint-Andre - Filament [mailto:[email-masked]] 
Sent: Friday, June 09, 2017 4:09 PM
To: Daniel Migault <[email-masked]>; [email-masked]
Cc: The IESG <[email-masked]>; [email-masked]
Subject: Re: secdir review of draft-ietf-precis-7700bis-07

> illustrate that the current profile does not prevent visually similar 

Well, those characters aren't visually similar. Section 12.5 of rfc7546bis talks about this in detail; although it does provide some examples, it might help to add more (e.g., CYRILLIC SMALL LETTER A
U+0430 vs. LATIN SMALL LETTER A U+0061).

Peter

--
Peter Saint-Andre
https://filament.com/
+1-720-256-6756