[secdir] Secdir review of draft-ietf-geopriv-deref-protocol-04

[Charlie Kaufman <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document specifies a relatively trivial extension to the HELD protocol to allow that protocol to be used to look up someone's (or something's) location. It's previous use was in connection with a device learning and/or setting its own location. It specifies an access control mechanism based on keeping location URIs secret and leaves open the possibility of alternate access control mechanisms being added in the future. It recommends use of TLS, but does not require it. The Security Considerations section addresses these issues well.

I see no security issues with this document.

I found no typos.

I have a few readability suggestions:

The document is not very free-standing, in that it would be difficult for someone outside the geopriv community to figure out what's going on in this document without reading some others first. It would be helpful if the introduction recommended some other RFC where such a context might be learned.

Section 3.3 paragraph 1 says: "This document does not describe a specific authentication mechanism. This means that authorization policies are unable to specifically identify authorized Location Recipients." As is clarified later in the section, what is really meant is that no mechanism for doing so is specified in this document. It is explicitly intended that such functionality be addable later without invalidating this document. In particular, paragraph 6 says: "Authentication of Location Recipients and use of identity-based authorization policy is not precluded." Clarifying that in the first paragraph would avoid confusion.

This last one is a real nit, but it bugged me...

Section 4.1 paragraph 3 says: "The LS MUST ignore any parameters that it does not understand unless it knows the parameters to be invalid". I would claim that you must understand something to know that it is invalid, and so would leave off the "unless" clause.