Secdir last call review of draft-ietf-httpbis-sfbis-05
Peter Yee via Datatracker <noreply@ietf.org> Tue, 13 February 2024 01:03 UTC
Return-Path: <ietf-http-wg-request+bounce-httpbisa-archive-bis2juki=ietf.org@listhub.w3.org>
X-Original-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Delivered-To: ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2FA36C15109A for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 12 Feb 2024 17:03:10 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.758
X-Spam-Level:
X-Spam-Status: No, score=-2.758 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_EF=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.249, MAILING_LIST_MULTI=-1, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=w3.org header.b="R7xEdVVt"; dkim=pass (2048-bit key) header.d=w3.org header.b="FuecMzyP"
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id fkLriWTyBGku for <ietfarch-httpbisa-archive-bis2Juki@ietfa.amsl.com>; Mon, 12 Feb 2024 17:03:09 -0800 (PST)
Received: from lyra.w3.org (lyra.w3.org [128.30.52.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange ECDHE (P-256) server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 548A8C15154D for <httpbisa-archive-bis2Juki@ietf.org>; Mon, 12 Feb 2024 17:02:46 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Subject:Date:Reply-To:Message-ID:Cc:To:From:Content-Type:MIME-Version :In-Reply-To:References; bh=0/92AV5NLzt/pbLp2Uwp7+fRLspYHNYwQkSBIWD7xmA=; b=R 7xEdVVtLm/f0D2e7LkJBUspzvKHy0sux4H3eksH1gAQGtjPct+CQcimiy7obrIDBm1A1fnUvJq6Tu N4kDpxE+ZLouFeHnCFE+LSBIbN/XBpwp96FY52AX3ga1cmf//jvnWOknEz8sSugHO6iLSUNlLTZyc vWamwgHb+MD6uWPWTVEfhDAk2WdZFsQlLY+I1MeiSV26daWY9kTAcvhlIGxOMAFTjBeUTgEhEqZ7C x4nLSyt2ETanHSs6kaU6oisYkDBiliQuCTTNcwlWWqxTeUB/UHmG4hEUMH6KlhDaLqfmh7s3cwom6 ujJMBNdzwz/LOVwILG/kcLRWgUohSKDJQ==;
Received: from lists by lyra.w3.org with local (Exim 4.94.2) (envelope-from <ietf-http-wg-request@listhub.w3.org>) id 1rZhBw-000lIW-S5 for ietf-http-wg-dist@listhub.w3.org; Tue, 13 Feb 2024 01:02:32 +0000
Resent-Date: Tue, 13 Feb 2024 01:02:32 +0000
Resent-Message-Id: <E1rZhBw-000lIW-S5@lyra.w3.org>
Received: from mimas.w3.org ([128.30.52.79]) by lyra.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <noreply@ietf.org>) id 1rZhBu-000lFH-AK for ietf-http-wg@listhub.w3.org; Tue, 13 Feb 2024 01:02:30 +0000
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=w3.org; s=s1; h=Date:Reply-To:Message-ID:Subject:Cc:To:From:Content-Type:MIME-Version :In-Reply-To:References; bh=0/92AV5NLzt/pbLp2Uwp7+fRLspYHNYwQkSBIWD7xmA=; t=1707786150; x=1708650150; b=FuecMzyPOUi+D8BJXxAOTVB4g06qbdqQlhjhlcOAQGqOkXk CnZK/d2vWfAfI+mtUF3pw7bCigjQ0QgfJmxUQqGEbV2HbVCRUXPzZ+TnLbfE6XISCrG3SQKlqh3Jq PPJh19Q27X5JzwYK/ZO78+4pUrP3tq2W4Cwg5qFonwaTFH1YR4v1DL9VsD1QOlD1MMF2q1YRk7qFL shIDYhqqKIvkBG6ILcWisFFGzWLLttePrfhRD4/ElybxaBj2wt32/6JRUldogcrhX+nOd0ybdM5Ad hyPGMDjaz09D6VTWUxHswXAALVNf0BfAb3C4LpilU3xS7WgUp7uTQqcNKhdJl6kg==;
Received: from mail.ietf.org ([50.223.129.194]) by mimas.w3.org with esmtps (TLS1.3) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94.2) (envelope-from <noreply@ietf.org>) id 1rZhBs-00C99W-Az for ietf-http-wg@w3.org; Tue, 13 Feb 2024 01:02:29 +0000
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 73DA1C17C88A; Mon, 12 Feb 2024 17:02:24 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Peter Yee via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Cc: draft-ietf-httpbis-sfbis.all@ietf.org, ietf-http-wg@w3.org, last-call@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 12.5.0
Auto-Submitted: auto-generated
Message-ID: <170778614444.35488.18046784505550673229@ietfa.amsl.com>
Reply-To: Peter Yee <peter@akayla.com>
Date: Mon, 12 Feb 2024 17:02:24 -0800
Received-SPF: pass client-ip=50.223.129.194; envelope-from=noreply@ietf.org; helo=mail.ietf.org
X-W3C-Hub-Spam-Status: No, score=-6.2
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: mimas.w3.org 1rZhBs-00C99W-Az 037678378b954183d4b911984ecf71ba
X-Original-To: ietf-http-wg@w3.org
Subject: Secdir last call review of draft-ietf-httpbis-sfbis-05
Archived-At: <https://www.w3.org/mid/170778614444.35488.18046784505550673229@ietfa.amsl.com>
Resent-From: ietf-http-wg@w3.org
X-Mailing-List: <ietf-http-wg@w3.org> archive/latest/51770
X-Loop: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list
List-Id: <ietf-http-wg.w3.org>
List-Help: <https://www.w3.org/email/>
List-Post: <mailto:ietf-http-wg@w3.org>
List-Unsubscribe: <mailto:ietf-http-wg-request@w3.org?subject=unsubscribe>
Reviewer: Peter Yee Review result: Ready This is a somewhat exhaustive (exhausting) specification for creating and handling HTTP Structured Fields. There's nothing cryptographic in here nor is the document overtly related to security. It's really about specifying the fields and being able to serialize and parse them. To that extent, parsing implementation tends to be the problem. This document calls out potential DoS issues with enormous fields, not always being able to correctly fail to parse a field, and Display String sanitization concerns. I've nothing to add on top of that, so I deem the document Ready.
- Secdir last call review of draft-ietf-httpbis-sfb… Peter Yee via Datatracker