[secdir] Secdir last call review of draft-ietf-netvc-requirements-09

Linda Dunbar via Datatracker <noreply@ietf.org> Tue, 28 May 2019 17:35 UTC

Return-Path: <noreply@ietf.org>
X-Original-To: secdir@ietf.org
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 43E3F120198; Tue, 28 May 2019 10:35:21 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Linda Dunbar via Datatracker <noreply@ietf.org>
To: <secdir@ietf.org>
Cc: draft-ietf-netvc-requirements.all@ietf.org, video-codec@ietf.org, ietf@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.97.0
Auto-Submitted: auto-generated
Precedence: bulk
Reply-To: Linda Dunbar <Linda.dunbar@huawei.com>
Message-ID: <155906492120.25733.13337604572333992432@ietfa.amsl.com>
Date: Tue, 28 May 2019 10:35:21 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/7aaKsnYXrj8jJZEscnks99nDWww>
Subject: [secdir] Secdir last call review of draft-ietf-netvc-requirements-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 28 May 2019 17:35:21 -0000

Reviewer: Linda Dunbar
Review result: Has Nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
 last call comments.

This document describes the overview of internet Video codec applications and
the corresponding requirements. However, it doesn't cover any security
requirement.

Section 5 on Security Consideration description doesn't make sense to me. It
stats that  not covering worst case of computational complexity/memory
bandwidth can be considered as security vulnerability and lead to denial of
services (DoS) in the case of attacks.

why ?

what are "the worst case of computational complexity/memory bandwidth"? why
covering them can eliminate the "security vulnerability"?

Linda Dunbar