Re: [secdir] secdir review of draft-ietf-calext-extensions-03

["Xialiang (Frank)" <[e-mail]>]

Great, thank you.

-----邮件原件-----
发件人: Cyrus Daboo [mailto:[e-mail]] 
发送时间: 2016年6月23日 1:07
收件人: Xialiang (Frank); '[e-mail]'; '[e-mail]'; [e-mail]
主题: Re: secdir review of draft-ietf-calext-extensions-03

Hi Xialiang,
Thank you for your review. Fixes described below have been made to my working copy and will be included in the next published draft.

--On June 22, 2016 at 1:39:06 AM +0000 "Xialiang (Frank)" 
<[e-mail]> wrote:

> Below is a series of my comments, nits for your consideration.
>
> comments:
> section 7
> 1. This section covers the possible new threats brought by new 
> properties and parameters, but does not mention how to mitigate them explicitly.
> Could you consider this point?

I've added some additional text to my working copy to cover that.

> 2. The "Security Considerations" section of [RFC5545] describes the 
> general security issues and its corresponding relation with the 
> transport protocol. It's clear and comprehensive. As the extension 
> draft to the iCalendar object specification, it's a good practice to 
> mention that the security considerations in [RFC5545] continue to 
> apply in this document.

I have added the follow text as the last paragraph of Security
Considerations:

    Security considerations in [RFC5545], and [RFC5546] MUST also be
    adhered to.

I have also added a Privacy Considerations section with similar text.

Also, on further review there were a couple of addition items I felt needed to be added to these sections. In particular text about short REFRESH-INTERVALs being used to trigger denial of service attacks.

> section 5.2--5.6
> These sections specify the extensive properties, and don't follow the 
> template in [RFC5545]. Would it be better to have some text for each 
> extensive property to point out its original specification in 
> [RFC5545] for easy understanding?

OK. I have added text in each of those sections providing a reference back to the section in RFC5545 where the original definitions reside.

> section 5.11
> The new property -- conference, is missed in the previous iCalendar 
> components' definition in section 4;

Fixed.

> nits:
> Section 8.1
> The section number of [RFC5545] referenced here is wrong, it should be 
> modified from 8.2.3 to 8.3.2;
>
> Section 8.2
> The section number of [RFC5545] referenced here is wrong, it should be 
> modified from 8.2.4 to 8.3.3;

Fixed.

--
Cyrus Daboo