Re: [secdir] secdir review for draft-holmberg-dispatch-rfc7315-updates-07

[Christer Holmberg <[e-mail]>]

Hi Steve,

Thanks for your comments! Please see inline.

>I have reviewed this document as part of the security directorate's
>ongoing effort to review all IETF documents being processed by the
>IESG.  These comments were written primarily for the benefit of the
>security area directors.  Document editors and WG chairs should treat
>these comments just like any other last call comments.
>
>This document updates RFC 7315 by changing restrictions on where
>certain SIP private header extensions may be included, in order to
>address new 3GPP use cases.
>
>This document is Ready with nits.
>
>I know little about SIP or 3GPP. I do know security, though.
>
>After reading this document and also reading the Security
>Considerations section of RFC 7315, I believe that this document
>is OK from a security standpoint. Few new security issues are
>raised by this document and those that arise are properly
>documented in the Security Considerations section of this
>document. However, there are a few typos in the Security
>Considerations section.
>
>* The second sentence of the Security Considerations section
>   ends with "the security considerations and assumptions (e.g.
>   regarding only sending information to trusted entities) also
>   to those messages." This clause is missing a verb. Maybe the
>   word "apply" should appear before "to those messages². Also,
>   greater clarity could be achieved by changing "the security
>   considerations and assumptions" in that sentence fragment to
>   "the security considerations and assumptions described in
>   RFC 7315".


I¹ll fix as suggested:


NEW:

"This specification allows some header fields to be
   present in messages where they were previously not
allowed, and the security considerations and assumptions
described in [RFC7315] (e.g. regarding only sending
   information to trusted entities) also apply to those
messages."



>
>* In the third sentence of the Security Considerations section,
>   "disallow" should be "disallows" and "message" should be
>   "messages".

I¹ll fix as suggested.


>* In the fourth sentence of the Security Considerations section,
>   "if a header field occur" should be "if a header field occurs".

I¹ll fix as suggested.

>With these minor changes, I think the document will be ready
>to go from a security standpoint.

Thanks!

Regards,

Christer