Re: [secdir] Review of draft-ietf-dime-diameter-api-08

[Sean Turner <[e-mail]>]

Dan,

I sent the review to Pat and to Dave (and the iesg and secdir).  I see 
that Victor was also added during the last go around so if he made the 
changes I'm not sure he would have seen them.

My concern is that the document is for the Diameter API but the security 
considerations points to the Diameter Protocol.  So, we don't have any 
security considerations at all if we just point to the protocol 
definition, which is what the document does now.

spt

Romascanu, Dan (Dan) wrote:
> Sean,
> 
> Was your review sent to the editors of the document? 
> 
> Can you please clarify why you believe that the API introduces
> supplementary security concerns, which would make the reference to the
> security considerations of RFC 5366 insufficient? 
> 
> Thanks and Regards,
> 
> Dan
> 
> 
>> -----Original Message-----
>> From: [e-mail] [mailto:[e-mail]] On 
>> Behalf Of Sean Turner
>> Sent: Tuesday, June 16, 2009 6:44 PM
>> To: secdir; [e-mail]; 
>> [e-mail]; [e-mail]
>> Cc: Hannes Tschofenig
>> Subject: Review of draft-ietf-dime-diameter-api-08
>>
>> I have reviewed this document (twice now) as part of the 
>> security directorate's ongoing effort to review all IETF 
>> documents being processed by the IESG. These comments were 
>> written primarily for the benefit of the security area 
>> directors. Document editors and WG chairs should treat these 
>> comments just like any other last call comments.
>>
>> This version does not address the comments I made against the 
>> -07 version, notably:
>>
>> The document needs to discuss the security considerations 
>> surrounding the API in your document, as opposed to just 
>> pointing to RFC5388.
>>
>> Nits:
>> - Sec 3.1.1: add "." to end of last sentence
>> - Sec 3.4.3.1 and 3.4.3.2: r/- The NAI of the user./The NAI 
>> of the user.
>> - Sec 3.4.5.7: Move description before C code.
>>
>> spt
>>
>