Re: [6lo] Secdir last call review of draft-ietf-6lo-nfc-13

최영환 <yhc@etri.re.kr> Fri, 08 March 2019 01:09 UTC

Return-Path: <yhc@etri.re.kr>
X-Original-To: 6lo@ietfa.amsl.com
Delivered-To: 6lo@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id AE673130E5B for <6lo@ietfa.amsl.com>; Thu, 7 Mar 2019 17:09:35 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.921
X-Spam-Level:
X-Spam-Status: No, score=-0.921 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, FROM_EXCESS_BASE64=0.979, RCVD_IN_DNSWL_NONE=-0.0001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id tVAykuiOnYDj for <6lo@ietfa.amsl.com>; Thu, 7 Mar 2019 17:09:34 -0800 (PST)
Received: from mscreen.etri.re.kr (mscreen.etri.re.kr [129.254.9.16]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 39FCF12008A for <6lo@ietf.org>; Thu, 7 Mar 2019 17:09:34 -0800 (PST)
Received: from unknown (HELO smtpeg.etri.re.kr) (129.254.27.141) by 129.254.9.16 with ESMTP; 8 Mar 2019 10:02:47 +0900
X-Original-SENDERIP: 129.254.27.141
X-Original-MAILFROM: yhc@etri.re.kr
X-Original-RCPTTO: ietf@ietf.org, 6lo@ietf.org, draft-ietf-6lo-nfc.all@ietf.org, noreply@ietf.org, secdir@ietf.org
Received: from SMTP4.etri.info (129.254.28.74) by SMTPEG1.etri.info (129.254.27.141) with Microsoft SMTP Server (TLS) id 14.3.319.2; Fri, 8 Mar 2019 10:02:51 +0900
Received: from SMTP2.etri.info ([169.254.2.66]) by SMTP4.etri.info ([10.2.6.33]) with mapi id 14.03.0319.002; Fri, 8 Mar 2019 10:02:49 +0900
From: =?utf-8?B?7LWc7JiB7ZmY?= <yhc@etri.re.kr>
To: Leif Johansson via Datatracker <noreply@ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
CC: "draft-ietf-6lo-nfc.all@ietf.org" <draft-ietf-6lo-nfc.all@ietf.org>, "ietf@ietf.org" <ietf@ietf.org>, "6lo@ietf.org" <6lo@ietf.org>, =?utf-8?B?6rmA7ZiV7KSA?= <khj@etri.re.kr>, =?utf-8?B?7J206rCV7LCs?= <chan@etri.re.kr>
Thread-Topic: Secdir last call review of draft-ietf-6lo-nfc-13
Thread-Index: AQHU1QO0oFBvvJOIJUa2ksNtJ2E2Z6YA58CA
Date: Fri, 8 Mar 2019 01:02:48 +0000
Message-ID: <B2C0C4C29044814AB285BBB7C754D9249AC52639@SMTP2.etri.info>
References: <155197648051.24840.16459568633516212522@ietfa.amsl.com>
In-Reply-To: <155197648051.24840.16459568633516212522@ietfa.amsl.com>
Accept-Language: ko-KR, en-US
Content-Language: ko-KR
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [129.254.170.124]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/6lo/lCK1CzNwhXu2CD6rS6HKAwZJJa8>
Subject: Re: [6lo] Secdir last call review of draft-ietf-6lo-nfc-13
X-BeenThere: 6lo@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: "Mailing list for the 6lo WG for Internet Area issues in IPv6 over constrained node networks." <6lo.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/6lo>, <mailto:6lo-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/6lo/>
List-Post: <mailto:6lo@ietf.org>
List-Help: <mailto:6lo-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/6lo>, <mailto:6lo-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Mar 2019 01:09:36 -0000

Dear Leif Johansson.

Thanks for your comments.
Please find the answer inline bellows:

BRs,
Younghwan Choi

-----Original Message-----
From: Leif Johansson via Datatracker <noreply@ietf.org> 
Sent: Friday, March 8, 2019 1:35 AM
To: secdir@ietf.org
Cc: draft-ietf-6lo-nfc.all@ietf.org; ietf@ietf.org; 6lo@ietf.org
Subject: Secdir last call review of draft-ietf-6lo-nfc-13

Reviewer: Leif Johansson
Review result: Has Issues

 I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

I am not a subject matter expert but overall I find the document well written and readable. 

YH>> Thanks a lot.

The issue I have is in the security considerations section where I really think there should be normative language around the use of permanent identifiers. In particular:

"Thus, every single touch connection can use a different short address of NFC link with an extremely short-lived link.  This can mitigate address scanning as well as location tracking and device-specific vulnerability exploitation."

This is imo too weak. I suggest reformulating this and related text to normative language. Given the possible consequences of NFC correlation attacks I would have thought that a mandatory requirement on generating different short addresses for every link would be a good idea.

YH>> I agree with your comment, so I would like to reformulate the sentences like followings:

YH>> "Thus, connections with every single touch between NFC-enabled devices MUST use different short addresses with extremely short-lived links. This also SHOULD mitigate the NFC correlation attacks, such as address scanning, location tracking, and device-specific vulnerability exploitation."

YH>> I will update the draft (-13) with the new sentences if it's ok.
YH>> Thanks again.