Re: [secdir] Review of draft-ietf-dime-diameter-api-08

[Sean Turner <[e-mail]>]

Dan,

If this is the case, then I'd suggest adding something to make it 
explicit that the API adds no additional security concerns.

spt

Romascanu, Dan (Dan) wrote:
> Sean,
> 
> I will let the authors infirm or confirm what I am saying, but my
> understanding is that they take the position that the document describes
> an internal API  for applications to access the Diameter protocol, and
> that there is no additional security threat involved in the definition
> or implementation of such an API. 
> 
> Dan
> 
> 
>> -----Original Message-----
>> From: Sean Turner [mailto:[e-mail]] 
>> Sent: Tuesday, June 16, 2009 9:01 PM
>> To: Romascanu, Dan (Dan)
>> Cc: secdir; [e-mail]; 
>> [e-mail]; [e-mail]; Hannes Tschofenig; 
>> Victor Fajardo; [e-mail]; [e-mail]
>> Subject: Re: Review of draft-ietf-dime-diameter-api-08
>>
>> Dan,
>>
>> I sent the review to Pat and to Dave (and the iesg and 
>> secdir).  I see that Victor was also added during the last go 
>> around so if he made the changes I'm not sure he would have seen them.
>>
>> My concern is that the document is for the Diameter API but 
>> the security considerations points to the Diameter Protocol.  
>> So, we don't have any security considerations at all if we 
>> just point to the protocol definition, which is what the 
>> document does now.
>>
>> spt
>>
>> Romascanu, Dan (Dan) wrote:
>>> Sean,
>>>
>>> Was your review sent to the editors of the document? 
>>>
>>> Can you please clarify why you believe that the API introduces 
>>> supplementary security concerns, which would make the 
>> reference to the 
>>> security considerations of RFC 5366 insufficient?
>>>
>>> Thanks and Regards,
>>>
>>> Dan
>>>
>>>
>>>> -----Original Message-----
>>>> From: [e-mail] [mailto:[e-mail]] 
>> On Behalf 
>>>> Of Sean Turner
>>>> Sent: Tuesday, June 16, 2009 6:44 PM
>>>> To: secdir; [e-mail];
>>>> [e-mail]; [e-mail]
>>>> Cc: Hannes Tschofenig
>>>> Subject: Review of draft-ietf-dime-diameter-api-08
>>>>
>>>> I have reviewed this document (twice now) as part of the security 
>>>> directorate's ongoing effort to review all IETF documents being 
>>>> processed by the IESG. These comments were written 
>> primarily for the 
>>>> benefit of the security area directors. Document editors and WG 
>>>> chairs should treat these comments just like any other last call 
>>>> comments.
>>>>
>>>> This version does not address the comments I made against the
>>>> -07 version, notably:
>>>>
>>>> The document needs to discuss the security considerations 
>> surrounding 
>>>> the API in your document, as opposed to just pointing to RFC5388.
>>>>
>>>> Nits:
>>>> - Sec 3.1.1: add "." to end of last sentence
>>>> - Sec 3.4.3.1 and 3.4.3.2: r/- The NAI of the user./The NAI of the 
>>>> user.
>>>> - Sec 3.4.5.7: Move description before C code.
>>>>
>>>> spt
>>>>
>