Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22

["Roman D. Danyliw" <[e-mail]>]

Hi Alexey!

> -----Original Message-----
> From: Alexey Melnikov [mailto:[e-mail]]
> Sent: Thursday, June 02, 2016 4:51 AM
> To: Roman D. Danyliw <[e-mail]>; Robert Sparks
> <[e-mail]>
> Cc: [e-mail]; [e-mail]; [e-mail];
> [e-mail]
> Subject: Re: [mile] Secdir review: draft-ietf-mile-5070-bis-22
> 
> Hi Roman,
> 
> On 02/06/2016 06:03, Roman D. Danyliw wrote:
> > Hello Robert!
> >
> > Thanks again for this review.  Comments are inline ...
> >
> >> -----Original Message-----
> >> From: Robert Sparks [mailto:[e-mail]]
> >> Sent: Monday, May 30, 2016 2:44 PM
> >> To: [e-mail]; [e-mail];
> >> [e-mail]
> >> Subject: Secdir review: draft-ietf-mile-5070-bis-22

[snip]

> > Consideration #3
> > ==============
> >
> > As Robert suggests, minimally, there needs to be a discussion in the
> security considerations on how these new enum values will securely be
> added to the schema/parser.  However, the question remains, what
> guidance do we provide about how often the IANA registry should be
> checked.
> >
> > ---[ begin Section 4.3]---
> >     Furthermore, the
> >     enumerated values present in this document are a static list that
> >     will be incomplete over time as select attributes can be extended by
> >     a corresponding IANA registry per Section 10.2.  Therefore, the
> >     schema to validate a given document MUST be dynamically generated
> >     from these registry values.
> > ---[ end Section 4.3 ]---
> >
> > ** Should we modify the last sentence as follows:
> >
> > "Therefore, the schema to validate a given document MUST be periodically
> regenerated from these registry values.  It is RECOMMENDED that this
> SHOULD NOT occur more frequently than xxx"
> >
> > Kathleen/Alexey/or any reader of this note: do you have a pointer to the
> prior discussion on dynamically generating a schema from an IANA registry
> referenced by Robert so that "xxx" can be populated?
> I have no idea about reasonable "xxx" values. This was never done before.
> (When it was suggested before IESG persuaded authors to change their
> documents.)

Understood.  Thanks for channeling the historical wisdom.

> While talking to www.iana.org directly from devices/programs is tempting, it
> might be better if vendors periodically download new values from IANA and
> then devices/programs talk to vendor's websites (or use vendor's update
> mechanisms).

What about language like the following in Section 4.3:

---[ begin Section 4.3]---

-- Therefore, the schema to validate a given document MUST 
-- be dynamically generated from these registry values.
++ Therefore, IODEF implementations MUST periodically update 
++ their schema and MAY need to update their parsing algorithms 
++ to incorporate newly registered values added 
++ to the IANA registries specified in Section xx.

---[ end Section 4.3 ]---

In addition, add text to the security considerations that this updating needs to be done securely.

Roman