[secdir] SECDIR review of draft-giralt-schac-ns

[Chris Lonvick <[e-mail]>]

Hi,

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

First off, can we get the status of the document straightened out?  The 
document says that it's STANDARDS TRACK but idtracker says that it's 
INFORMATIONAL.

The only security concern I have is that the registration URN is not yet 
active and that it is limited to HTTPS.  While I think it is still going 
to take some time for this ID to become an RFC, I'd just like to see the 
web site set up sooner rather than later so the kinks may be ironed out. 
Beyond that, I think that it would be better to state that it will always 
be a "secure web site" which will offer credentials signed by such-n-such, 
and will require the latest secure methods for accessing a web site; that 
currently being http [reference] with the latest TLS transport 
[reference].  My issue with this is that "https" can still reference SSLv2 
and I don't think that's the intent of the statement in this ID.

I don't have any concerns about the Security Considerations section other 
than the statement about using "HTTPS" as noted above.

I do have a few nits that the authors may want to address.

The terms TERENA and TF-EMC2 are used without first defining them.  Maybe 
some changes in Section 1.
CURRENT:
    The SCHAC international activity was born inside the TF-EMC2
    middleware task force of the Trans European Research and Education
    Network Association.  The initial aim of SCHAC was to harmonise the
PROPOSED:
    The SCHAC international activity was born inside the TF-EMC2 (Task
    Force on European Middleware Coordination and Collaboration)
    of the Trans European Research and Education Network Association
    (TERENA).  The initial aim of SCHAC was to harmonise the...

I think that the second paragraph of the Abstract could use some 
polishing.
CURRENT:
    This namespace is for naming persistent resources defined by the
    SCHAC international activity participants, their working groups and
    other designated subordinates.  The namespace main use will be the
    creation of controlled vocabulary values for attributes in the SCHAC
    schema.  This values will be associated to particular instances of
    persons or objects belonging to any of the SCHAC object classes.
SUGGESTED:
    The namespace described in this document is for naming persistent
    resources defined by the SCHAC participants internationally, their
    working groups, and other designated subordinates.  The main use of
    this namespace will be for the creation of controlled vocabulary values
    for attributes in the SCHAC schema.  These values will be associated
    with particular instances of persons or objects belonging to any of the
    SCHAC object classes.

In Section 4, the word "Anyhow" is ambiguous.  I'd suggest replacing it 
with a more definite word such as "Regardless", or with the term "In any 
case".

In Section 5, the term "NREN" is not defined before it is used.  I'd 
suggest:
CURRENT:
    The assignment and use of identifiers within the namespace are open,
    and the related rule is established by the SCHAC activity members.
    Registration agencies (the next level naming authorities) will be the
    National Research and Education Networks and established
    organizational cross-border organizations that participate in SCHAC.
SUGGESTED:
    The assignment and use of identifiers within the namespace are open,
    and the related rule is established by the SCHAC activity members.
    Registration agencies (the next level naming authorities) will be the
    National Research and Education Networks (NRENS) and other established,
    cross-border organizations that participate in SCHAC.

In the third paragraph of Section 5, remove the term "as soon as 
practical".  ...just get it done.  :-)

Could you add a URL to reference [4]?

Best regards,
Chris