[Cellar] Re: Andy Newton's Discuss on draft-ietf-cellar-tags-20: (with DISCUSS and COMMENT)

[Steve Lhomme <[e-mail]>]

Hi Spencer, Andy,

> On 23 Feb 2026, at 17:41, Spencer Dawkins at IETF <[e-mail]> wrote:
> 
> Hi, Andy and Steve, 
> 
> I'm following up on your DISCUSS ballot. I see one DISCUSS comment that hasn't been addressed (and I don't think it's been DISCUSSed enough). 
> 
> I THINK ...
> 
> On Mon, Jan 12, 2026 at 2:08 PM Andy Newton <[e-mail] <mailto:[e-mail]>> wrote:
>> 
>> 
>> On 1/11/26 7:20 AM, Steve Lhomme wrote:
>> 
>> > 
>> >> And from your Security Considerations sections:
>> >>
>> >> 1671       Most of the time strings are kept as-is and don't pose a security
>> >> 1672       issue, apart from invalid UTF-8 values.  Implementations MUST
>> >> 1673       validate TagString inputs for UTF-8 correctness and reasonable length
>> >> 1674       before use, in accordance with the security considerations in
>> >> 1675       Section 10 of [RFC3629].
>> >>
>> >> I think you have to apply RFC 9839 to make a statement that UTF-8 values
>> >> don't apply a security risk.
>> > 
>> > Not being a UTF-8 or security experts, I’d rather stick with the Security Considerations of the  RFC that defines UTF-8. 
>> 
>> The problem is that you say the strings "don't pose a security risk", except 9839 discusses why they can. IMO, you can't make that claim without accounting for problematic code points.

It doesn’t say it’s not pose any security risks. The full sentence is “Most of the time strings are kept as-is and don't pose a security issue, apart from invalid UTF-8 values.”.  And the paragraph has a link to the section has a link to the security of considerations of RFC3629.

> ... Andy is asking that our Security Considerations point to RFC 9839, and especially to Section 3 of that document. The point is not that CELLAR has to figure out how to avoid security risks, it's that we need to point out risks for problematic code points. 
> 
> If I got that right, I'd add 
> 
> [RFC9839] discusses the risks encountered with problematic code points in more detail.
> 
> to the end of our paragraph. 
> 
> Does that make sense?

Yes. I added a Pull Request to mention the security considerations of RFC9839: https://github.com/ietf-wg-cellar/matroska-specification/pull/1074

It itself references the security considerations of RFC8264...

> Best,
> 
> Spencer