Subject: Re: [secdir] Security review of draft-hodges-webauthn-registries-05

From: Mike Jones <[email-masked]>
Date: Wed, 13 May 2020 23:50:15 +0000

Thanks for the review, Hilarie.  My replies are inline below, prefixed by "Mike>".

-----Original Message-----
From: Hilarie Orman <[email-masked]> 
Sent: Monday, April 27, 2020 9:42 PM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: Security review of draft-hodges-webauthn-registries-05

       Security review of Registries for Web Authentication
      	       draft-hodges-webauthn-registries-05

Do not be alarmed.  I generated this review of this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving security requirements and considerations in IETF drafts.  Comments not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document establishes two registries required for the W3C Web Authentication system.  The registries are for the WebAuthn Attestation Statement Format Identifier and the WebAuthn Extension Identifier.

When submitted, these entries must be approved by an "expert" based on the specification that defines the parameters of the entry.  This includes "security considerations", which is good.  I don't quite see how submission of a request for a new entry gets routed to an expert, how experts come into being, etc., but I suppose that is a W3C procedure.

A couple of nits.

This url is listed twice in the URIs:
https://www.iana.org/assignments/webauthn
but it does not exist.  I expected at least a TBD message, unless the address itself is a placeholder.

Mike> The draft includes this TBD text "[[ Per discussions in an email thread between the authors and IANA ( "[IANA #1154148]" ), it is requested that the registries be located at <https://www.iana.org/assignments/webauthn>. RFC Editor - please delete this request after the registries have been created. ]]" before the two occurrences that you cite.

In 2.1
"The Experts(s) MAY also designate attestation
   statement formats as proprietary if they lack complete
   specifications, and will assign a prefix indicating as such to the
   identifier."  
It is not clear what the format of that prefix is or how indicates "as such".  Is that an indication that it is proprietary or (and?) that it is incomplete?

Mike>  The text you cited is unnecessary for the purposes of the specification and will be deleted.

Hilarie

Mike> You can see proposed updated source for -06 at https://github.com/w3c/webauthn/pull/1415.

				Thanks again,
				-- Mike

---

From: "Hilarie Orman" <[email-masked]>
Date: Thu, 14 May 2020 11:22:48 -0600

The only nit, then, is that the URI was listed twice in section 6.2.  It is
listed in entry 6 and entry 9.

Hilarie

>  Mike> You can see proposed updated source for -06 at https://github.com/w3c/webauthn/pull/1415 .