Re: [secdir] SECDIR review of draft-ietf-cbor-cddl-05

[Carsten Bormann <[e-mail]>]

Hi Chris,

thank you for this review.

> On Sep 28, 2018, at 23:10, Chris Lonvick <[e-mail]> wrote:
> 
> Hello,
> 
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. 
> 
> The summary of the review is READY with nits.
> 
> I skimmed through the draft and agree with the author's statement in the first paragraph of the Security Considerations section:
>    This document presents a content rules language for expressing CBOR
>    data structures.  As such, it does not bring any security issues on
>    itself, although specification of protocols that use CBOR naturally
>    need security analysis when defined.
> 
> (As a very minor nit, I'd suggest using "analyses" rather than "analysis".)
> 
> Nit 1: The authors have made a good effort at identifying some of the topics that may be considered in a security considerations section of specifications that use protocols using CDDL to define CBOR structures. However, I would recommend that those bullet points be used to supplement a normative reference to RFC 3552 “Security Considerations Guidelines". 

> 
> Perhaps adding the following between the first and second paragraphs:
>    Guidelines for writing security considerations are defined in Security Considerations Guidelines [RFC 3552] 
>    (BCP 72).  Implementers using CDDL to define CBOR structures in protocols must follow those guidelines.
> 
> Then change the start of the second paragraph from “Topics that may be..." to "Additional topics that may be..."

I think this is a very good idea.  It is now addressed (with slightly different wording) in
https://github.com/cbor-wg/cddl/commit/d3b2483f1b7a94eb9ba9cab22143c43f1be8909d
(which will be in -06).

> Nit 2: I am not very familiar with all of this, but it seems to me that RFC 8152, "CBOR Object Signing and Encryption (COSE)" should be a normative reference rather than an informative reference, and some mention should be made of it in the Security Considerations section. Reference is made in RFC 8152 to CDDL (4th paragraph in Section 1.3):
>    As well as the prose description, a version of a CBOR grammar is
>    presented in CDDL.  Since CDDL has not been published in an RFC, this
>    grammar may not work with the final version of CDDL.  The CDDL
>    grammar is informational; the prose description is normative.
> 
> I may be off base here, but it just seems that since 8152 has been published as a Standards Track document, then this draft should normatively reference it and any subsequent updates to 8152 should normatively reference the Standards Track RFC issuing from this draft. 

It is indeed true that COSE (RFC 8152) uses CDDL, and even goes ahead to quickly define the subset it uses in its section 1.3 (with the slightly confusing title “CBOR grammar”).
That does not make the COSE specification a normative reference for CDDL though — many protocols specified in CDDL will not make use of COSE, and those that do will rightly reference COSE as a normative reference.  There is no need to read section 1.3 of RFC 8152 to use the specification of CDDL.
I do agree that a COSEbis (which might be started about now) could use the specification of CDDL as a normative reference (if the downref is accepted), but we don’t have to have a position on that now.

Grüße, Carsten