Re: [secdir] Review of draft-ietf-dime-diameter-api-08

[David Frascone <[e-mail]>]

Ok.  Will do.

-Dave

On Sun, Jun 21, 2009 at 1:21 PM, Sean Turner<[e-mail]> wrote:
> Dan,
>
> If this is the case, then I'd suggest adding something to make it explicit
> that the API adds no additional security concerns.
>
> spt
>
> Romascanu, Dan (Dan) wrote:
>>
>> Sean,
>>
>> I will let the authors infirm or confirm what I am saying, but my
>> understanding is that they take the position that the document describes
>> an internal API  for applications to access the Diameter protocol, and
>> that there is no additional security threat involved in the definition
>> or implementation of such an API.
>> Dan
>>
>>
>>> -----Original Message-----
>>> From: Sean Turner [mailto:[e-mail]] Sent: Tuesday, June 16, 2009
>>> 9:01 PM
>>> To: Romascanu, Dan (Dan)
>>> Cc: secdir; [e-mail]; [e-mail];
>>> [e-mail]; Hannes Tschofenig; Victor Fajardo; [e-mail];
>>> [e-mail]
>>> Subject: Re: Review of draft-ietf-dime-diameter-api-08
>>>
>>> Dan,
>>>
>>> I sent the review to Pat and to Dave (and the iesg and secdir).  I see
>>> that Victor was also added during the last go around so if he made the
>>> changes I'm not sure he would have seen them.
>>>
>>> My concern is that the document is for the Diameter API but the security
>>> considerations points to the Diameter Protocol.  So, we don't have any
>>> security considerations at all if we just point to the protocol definition,
>>> which is what the document does now.
>>>
>>> spt
>>>
>>> Romascanu, Dan (Dan) wrote:
>>>>
>>>> Sean,
>>>>
>>>> Was your review sent to the editors of the document?
>>>> Can you please clarify why you believe that the API introduces
>>>> supplementary security concerns, which would make the
>>>
>>> reference to the
>>>>
>>>> security considerations of RFC 5366 insufficient?
>>>>
>>>> Thanks and Regards,
>>>>
>>>> Dan
>>>>
>>>>
>>>>> -----Original Message-----
>>>>> From: [e-mail] [mailto:[e-mail]]
>>>
>>> On Behalf
>>>>>
>>>>> Of Sean Turner
>>>>> Sent: Tuesday, June 16, 2009 6:44 PM
>>>>> To: secdir; [e-mail];
>>>>> [e-mail]; [e-mail]
>>>>> Cc: Hannes Tschofenig
>>>>> Subject: Review of draft-ietf-dime-diameter-api-08
>>>>>
>>>>> I have reviewed this document (twice now) as part of the security
>>>>> directorate's ongoing effort to review all IETF documents being processed by
>>>>> the IESG. These comments were written
>>>
>>> primarily for the
>>>>>
>>>>> benefit of the security area directors. Document editors and WG chairs
>>>>> should treat these comments just like any other last call comments.
>>>>>
>>>>> This version does not address the comments I made against the
>>>>> -07 version, notably:
>>>>>
>>>>> The document needs to discuss the security considerations
>>>
>>> surrounding
>>>>>
>>>>> the API in your document, as opposed to just pointing to RFC5388.
>>>>>
>>>>> Nits:
>>>>> - Sec 3.1.1: add "." to end of last sentence
>>>>> - Sec 3.4.3.1 and 3.4.3.2: r/- The NAI of the user./The NAI of the
>>>>> user.
>>>>> - Sec 3.4.5.7: Move description before C code.
>>>>>
>>>>> spt
>>>>>
>>
>