Re: [secdir] SECDIR Review of http://tools.ietf.org/html/draft-krishnan-nomcom-tools-01

[Sean Turner <[e-mail]>]

Any additional thoughts on the cipher suite?  I think RSA is probably 
the right alg.  2048-bit is the minimum key size.  And, I think we 
should eat our own dogfood and not use MD5/SHA-1 and instead use 
SHA-256.  How do others feel about this?

spt

On 6/29/12 8:45 PM, Suresh Krishnan wrote:
> Hi Phil,
>    Thanks for the review. Please find responses inline.
>
> On 06/27/2012 10:20 AM, Phillip Hallam-Baker wrote:
>> I have reviewed this document as part of the security directorate's
>> ongoing effort to review all IETF documents being processed by the
>> IESG.  These comments were written primarily for the benefit of the
>> security area directors. Document editors and WG chairs should treat
>> these comments just like any other last call comments.
>>
>>
>> Surprisingly for a non protocol draft, this one actually is almost
>> completely security requirements. Unfortunately I find it rather hard
>> to tell if the security architecture meets the security goals because
>> they are not separated from each other.
>>
>> I think the document should have a section stating the security goals
>> or reference another document that states them. Presumably these are
>> all derived from the Nomcom RFC.
>
> The goals are derived from RFC3777
>
> * Section 3 Rule 6
>
> "     All deliberations and supporting information that relates to
>        specific nominees, candidates, and confirmed candidates are
>        confidential."
>
> * Section 5 Rule 16
>
> "      The nominating committee should archive the information it has
>         collected or produced for a period of time not to exceed its
>         term.
>         ...
>         The implementation of the archive should make every reasonable
>         effort to ensure that the confidentiality of the information it
>         contains is maintained."
>
>
>>
>>
>> The document specifies creation of a public key but not the algorithm
>> or strength. Given that this is an RFP, I think it would be
>> appropriate to completely and uniquely specify the cipher suite to be
>> supported.
>
> As stated in the draft, the key is generated by the Nomcom chair out of
> band and not by the tool. In the example provided in Appendix A (based
> on what I actually did as chair), the key used is a RSA 2048-bit key.
> Since I am not even remotely close to a security expert :-), it would be
> great if you can provide suggestions to put in here for future Nomcom
> chairs.
>
> Thanks
> Suresh
> _______________________________________________
> secdir mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
>