Subject: Re: [secdir] Security review of draft-hodges-webauthn-registries-05

From: Mike Jones <[email-masked]>
Date: Thu, 14 May 2020 18:34:13 +0000

Oh, I see what you mean now.  I didn't realize that the tool wouldn't coalesce multiple instances of the same URI to a single reference.  I'll do something to eliminate the duplication now.

				Thanks again,
				-- Mike

-----Original Message-----
From: Hilarie Orman <[email-masked]> 
Sent: Thursday, May 14, 2020 10:23 AM
To: Mike Jones <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: Security review of draft-hodges-webauthn-registries-05

The only nit, then, is that the URI was listed twice in section 6.2.  It is listed in entry 6 and entry 9.

Hilarie

>  Thanks for the review, Hilarie.  My replies are inline below, prefixed by "Mike>".

>  -----Original Message-----
>  From: Hilarie Orman <[email-masked]>
>  Sent: Monday, April 27, 2020 9:42 PM
>  To: [email-masked]; [email-masked]
>  Cc: [email-masked]
>  Subject: Security review of draft-hodges-webauthn-registries-05

>	  Security review of Registries for Web Authentication
>		  draft-hodges-webauthn-registries-05

>  Do not be alarmed.  I generated this review of this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written with the intent of improving security requirements and considerations in IETF drafts.  Comments not addressed in last call may be included in AD reviews during the IESG review.  Document editors and WG chairs should treat these comments just like any other last call comments.

>  This document establishes two registries required for the W3C Web Authentication system.  The registries are for the WebAuthn Attestation Statement Format Identifier and the WebAuthn Extension Identifier.

>  When submitted, these entries must be approved by an "expert" based on the specification that defines the parameters of the entry.  This includes "security considerations", which is good.  I don't quite see how submission of a request for a new entry gets routed to an expert, how experts come into being, etc., but I suppose that is a W3C procedure.

>  A couple of nits.

>  This url is listed twice in the URIs:
>  https://www.iana.org/assignments/webauthn
>  but it does not exist.  I expected at least a TBD message, unless the address itself is a placeholder.

>  Mike> The draft includes this TBD text "[[ Per discussions in an email thread between the authors and IANA ( "[IANA #1154148]" ), it is requested that the registries be located at <https://www.iana.org/assignments/webauthn>. RFC Editor - please delete this request after the registries have been created. ]]" before the two occurrences that you cite.

>  In 2.1
>  "The Experts(s) MAY also designate attestation
>     statement formats as proprietary if they lack complete
>     specifications, and will assign a prefix indicating as such to the
>     identifier."  
>  It is not clear what the format of that prefix is or how indicates "as such".  Is that an indication that it is proprietary or (and?) that it is incomplete?

>  Mike>  The text you cited is unnecessary for the purposes of the specification and will be deleted.

>  Hilarie

>  Mike> You can see proposed updated source for -06 at https://github.com/w3c/webauthn/pull/1415 .

>				   Thanks again,
>				   -- Mike

---

From: Mike Jones <[email-masked]>
Date: Thu, 14 May 2020 20:43:29 +0000

The duplicate URI has been removed from https://tools.ietf.org/html/draft-hodges-webauthn-registries-07#section-6.2.  We should be good to go now!

				Thanks again,
				-- Mike

-----Original Message-----
From: Mike Jones 
Sent: Thursday, May 14, 2020 11:34 AM
To: Hilarie Orman <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: Security review of draft-hodges-webauthn-registries-05

				Thanks again,
				-- Mike

-----Original Message-----
From: Hilarie Orman <[email-masked]> 
Sent: Thursday, May 14, 2020 10:23 AM
To: Mike Jones <[email-masked]>
Cc: [email-masked]; [email-masked]; [email-masked]; [email-masked]
Subject: RE: Security review of draft-hodges-webauthn-registries-05

Hilarie

---

From: Roman Danyliw <[email-masked]>
Date: Tue, 19 May 2020 17:55:58 +0000

Hi Hilarie, thank you for this review.  

Hi Mike, thank you for incorporating the feedback.  

I entered a No Objection ballot.

Regards,
Roman

> From: iesg <[email-masked]> On Behalf Of Mike Jones
> Sent: Thursday, May 14, 2020 4:43 PM
> To: Hilarie Orman <[email-masked]>; [email-masked]
> Cc: [email-masked]; [email-masked];
> [email-masked]
> The duplicate URI has been removed from https://tools.ietf.org/html/draft-
> hodges-webauthn-registries-07#section-6.2.  We should be good to go now!
> 
> 				Thanks again,
> 				-- Mike
> 
> Oh, I see what you mean now.  I didn't realize that the tool wouldn't coalesce
> multiple instances of the same URI to a single reference.  I'll do something to
> eliminate the duplication now.
> 
> 				Thanks again,
> 				-- Mike
> 
> >  Do not be alarmed.  I generated this review of this document as part of the
> security directorate's ongoing effort to review all IETF documents being
> processed by the IESG.  These comments were written with the intent of
> improving security requirements and considerations in IETF drafts.  Comments
> not addressed in last call may be included in AD reviews during the IESG review.
> Document editors and WG chairs should treat these comments just like any
> other last call comments.
> 
> >  This document establishes two registries required for the W3C Web
> Authentication system.  The registries are for the WebAuthn Attestation
> Statement Format Identifier and the WebAuthn Extension Identifier.
> 
> >  When submitted, these entries must be approved by an "expert" based on
> the specification that defines the parameters of the entry.  This includes
> "security considerations", which is good.  I don't quite see how submission of a
> request for a new entry gets routed to an expert, how experts come into being,
> etc., but I suppose that is a W3C procedure.
> 
> >  A couple of nits.
> 
> >  Mike> The draft includes this TBD text "[[ Per discussions in an email thread
> between the authors and IANA ( "[IANA #1154148]" ), it is requested that the
> registries be located at <https://www.iana.org/assignments/webauthn>. RFC
> Editor - please delete this request after the registries have been created. ]]"
> before the two occurrences that you cite.
> 
> >  In 2.1
> >  It is not clear what the format of that prefix is or how indicates "as such".  Is
> that an indication that it is proprietary or (and?) that it is incomplete?
> 
> >  Mike> You can see proposed updated source for -06 at
> https://github.com/w3c/webauthn/pull/1415 .
> 
> >				   Thanks again,
> >				   -- Mike