Re: [secdir] Review of draft-ietf-dime-diameter-api-08

[Victor Fajardo <[e-mail]>]

Hi Dan,


> I will let the authors infirm or confirm what I am saying, but my
> understanding is that they take the position that the document describes
> an internal API  for applications to access the Diameter protocol, and
> that there is no additional security threat involved in the definition
> or implementation of such an API. 
>   

Yes. This is our understanding as well. Defining functions and 
structures does not seem to introduce any security concerns to us. It is 
possible that implementors introduced security vulnerabilities when 
implementing internals of the API's (etc. bug in code, weak algorithms, 
data structures that will not scale etc.). However, these are outside 
the scope of the document. If this is something to be clarified then we 
can add text stating this.

regards,
victor

> Dan
>
>
>   
>> -----Original Message-----
>> From: Sean Turner [mailto:[e-mail]] 
>> Sent: Tuesday, June 16, 2009 9:01 PM
>> To: Romascanu, Dan (Dan)
>> Cc: secdir; [e-mail]; 
>> [e-mail]; [e-mail]; Hannes Tschofenig; 
>> Victor Fajardo; [e-mail]; [e-mail]
>> Subject: Re: Review of draft-ietf-dime-diameter-api-08
>>
>> Dan,
>>
>> I sent the review to Pat and to Dave (and the iesg and 
>> secdir).  I see that Victor was also added during the last go 
>> around so if he made the changes I'm not sure he would have seen them.
>>
>> My concern is that the document is for the Diameter API but 
>> the security considerations points to the Diameter Protocol.  
>> So, we don't have any security considerations at all if we 
>> just point to the protocol definition, which is what the 
>> document does now.
>>
>> spt
>>
>> Romascanu, Dan (Dan) wrote:
>>     
>>> Sean,
>>>
>>> Was your review sent to the editors of the document? 
>>>
>>> Can you please clarify why you believe that the API introduces 
>>> supplementary security concerns, which would make the 
>>>       
>> reference to the 
>>     
>>> security considerations of RFC 5366 insufficient?
>>>
>>> Thanks and Regards,
>>>
>>> Dan
>>>
>>>
>>>       
>>>> -----Original Message-----
>>>> From: [e-mail] [mailto:[e-mail]] 
>>>>         
>> On Behalf 
>>     
>>>> Of Sean Turner
>>>> Sent: Tuesday, June 16, 2009 6:44 PM
>>>> To: secdir; [e-mail];
>>>> [e-mail]; [e-mail]
>>>> Cc: Hannes Tschofenig
>>>> Subject: Review of draft-ietf-dime-diameter-api-08
>>>>
>>>> I have reviewed this document (twice now) as part of the security 
>>>> directorate's ongoing effort to review all IETF documents being 
>>>> processed by the IESG. These comments were written 
>>>>         
>> primarily for the 
>>     
>>>> benefit of the security area directors. Document editors and WG 
>>>> chairs should treat these comments just like any other last call 
>>>> comments.
>>>>
>>>> This version does not address the comments I made against the
>>>> -07 version, notably:
>>>>
>>>> The document needs to discuss the security considerations 
>>>>         
>> surrounding 
>>     
>>>> the API in your document, as opposed to just pointing to RFC5388.
>>>>
>>>> Nits:
>>>> - Sec 3.1.1: add "." to end of last sentence
>>>> - Sec 3.4.3.1 and 3.4.3.2: r/- The NAI of the user./The NAI of the 
>>>> user.
>>>> - Sec 3.4.5.7: Move description before C code.
>>>>
>>>> spt
>>>>
>>>>         
>
>
>
>