Re: [secdir] secdir review of draft-ietf-slim-negotiating-human-language-22

[Randall Gellens <[e-mail]>]

At 3:26 AM +0000 1/11/18, Taylor Yu wrote:

>  I have reviewed this document as part of the security directorate's
>  ongoing effort to review all IETF documents being processed by the
>  IESG.  These comments were written primarily for the benefit of the
>  security area directors.  Document editors and WG chairs should treat
>  these comments just like any other last call comments.
>
>  Summary: ready with minor issues
>
>  The security considerations section seems mostly reasonable.  The
>  emergency services use case vaguely bothered me in ways I couldn't quite
>  articulate at first, but I think Alissa Cooper's ballot comment about
>  denying emergency services by manipulating these attributes captures
>  most of the essence.
>
>  I would add for that these new language tags, integrity seems to be a
>  stronger requirement than confidentiality, at least in the emergency
>  calling use case.

Hi Taylor,

Thanks for your review.  In response to Alissa's comments, I reworded 
the Security Considerations section to read:

    The Security Considerations of BCP 47 [RFC5646] apply here.  An
    attacker with the ability to modify signaling could prevent a call
    from succeeding by altering any of several crucial elements,
    including the 'hlang-send' or 'hlang-recv' values.  RFC 5069
    [RFC5069] discusses such threats.  Use of TLS or IPSec can protect
    against such threats.  Emergency calls are of particular concern; RFC
    6881 [RFC6881], which is specific to emergency calls, mandates use of
    TLS or IPSec (in ED-57/SP-30).

I think this also addresses your concern regarding integrity, as it 
specifically calls out "modification" as a principal threat.

--Randall



-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly selected tag: ---------------
Substitute "damn" every time you're inclined to write "very"; your
editor will delete it and the writing will be just as it should be.
              --William Allen White (famed Kansas newspaper editor)