[secdir] Re: draft-ietf-rift-kv-tie-structure-and-processing-05 ietf last call Secdir review
Christian Kuhtz <christian@kuhtz.com> Tue, 11 November 2025 01:21 UTC
Return-Path: <christian@kuhtz.com>
X-Original-To: secdir@mail2.ietf.org
Delivered-To: secdir@mail2.ietf.org
Received: from localhost (localhost [127.0.0.1]) by mail2.ietf.org (Postfix) with ESMTP id 504D9873AA87 for <secdir@mail2.ietf.org>; Mon, 10 Nov 2025 17:21:36 -0800 (PST)
X-Virus-Scanned: amavisd-new at ietf.org
X-Spam-Flag: NO
X-Spam-Score: -2.099
X-Spam-Level:
X-Spam-Status: No, score=-2.099 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: mail2.ietf.org (amavisd-new); dkim=pass (1024-bit key) header.d=kuhtz.com
Received: from mail2.ietf.org ([166.84.6.31]) by localhost (mail2.ietf.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Fndw75Svr6Nr for <secdir@mail2.ietf.org>; Mon, 10 Nov 2025 17:21:35 -0800 (PST)
Received: from mail-ej1-x635.google.com (mail-ej1-x635.google.com [IPv6:2a00:1450:4864:20::635]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (P-256) server-digest SHA256) (No client certificate requested) by mail2.ietf.org (Postfix) with ESMTPS id 58451873AA6F for <secdir@ietf.org>; Mon, 10 Nov 2025 17:21:35 -0800 (PST)
Received: by mail-ej1-x635.google.com with SMTP id a640c23a62f3a-b728a43e410so786744066b.1 for <secdir@ietf.org>; Mon, 10 Nov 2025 17:21:35 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kuhtz.com; s=google; t=1762824094; x=1763428894; darn=ietf.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=3wgGLFfv8r1C8S2voPwfFGbRqrEGQ9w2TsLoIEFfUy0=; b=bqTmDDE4w16PWFYmKMFn8ayIR6vIUiEkCqDLFtGjfU9z4tAZjWx0QEZ3EtTu/z9Mu4 8ay90kpW1THNhAZ7Vh0tGt0ptZmIqzg3JQ6l43IFQy+cL7ETGUz3Y1Ey64AZsrDzz6aV kdffTjtr7S3ZEvQ+CO0MNdKxm5rbj3bUmGbAg=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1762824094; x=1763428894; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=3wgGLFfv8r1C8S2voPwfFGbRqrEGQ9w2TsLoIEFfUy0=; b=qEUgQVG2DZU+qKP+G1yIdjvw5JTn8D0YWGR6C4o0nDfgTVKdgb8FIgWpmLczEOBLjq kVfiWr6IRGdCCtZa0OFD9YpmrsMEi/RRUpwGAh5H5+XqiNPmJNn7+7bEWQ3OZAxWO+49 Fyzjk1SoIeMPa64F0fsCpFd7JCzBq2iOtSoTx+lAR5fz3S2BsOYzYYMTWKvMRFLCh9ap i3ApLCHnw7dNLRebJS8mqwrqxO0DmABIbPGWSdWGNiAj4IC+DL3TskVQxennOxVNicbX CpfWCS5o5+Ff2BNv39VAgkn9hrVAhWp2iLzrptT6sGHXYNiLcFKwWQLuIDGMywCH9j60 X0Tg==
X-Forwarded-Encrypted: i=1; AJvYcCVWMLXEY6DJEdnMDtayFtQoSrtqfvYyYwyjZbRvXD8UZV6Uc1mm//ef0fvdIPL/+JuHPiksYSM=@ietf.org
X-Gm-Message-State: AOJu0Yzsr+52Z6Tdsz5TuzhmM1dVMaMXAS9U2tknKLjd+f7Wmi8VGQap xjFwXhLAR1RINLWIDqtBoOrcsdG7DxMXkwuj+fp0M7RwcA3qntvBuBpU5qWxSGUDocWl5lbaouT HwnD06AWrW1438jw1o2F+A46Twhs8o1vMt1r4/z+hww==
X-Gm-Gg: ASbGncvvj6sKf+WkeETvYkJt3On9UCDq1XLoYkJiNizUE9fBB/erbRID5a16ahjmrmv Ef08L7EqAaGlGbvuAb/nryJaA4ruSzilUx6v9tdatcX/Snq1FDjqH8/cJCNJKOScuQ/FYAU0e4L j/cVXLOlyAjS9AM2JfLgXK+glxEqpMHQRo0i1jyNu7234H/UyNfakqpldm4hxjRGi4rqwNiShv+ MCADlYCeTKtJeIye3Zu1KwSYMRzSgwt6ihty91lJu+27XBKglX9EHBJ4ucoGkJAdLGVqdk=
X-Google-Smtp-Source: AGHT+IFoq4UJe30xlxyNEoEwpEvGwHG4D1LzLQM3Yx3lK4aUlpVgxgADKCTEc6UxCzgT1BGcaMtnPPveUgQ1uePLXSE=
X-Received: by 2002:a17:907:869f:b0:b70:d149:c33c with SMTP id a640c23a62f3a-b72e041c0admr944809166b.22.1762824094385; Mon, 10 Nov 2025 17:21:34 -0800 (PST)
Received: from 1064022179695 named unknown by gmailapi.google.com with HTTPREST; Tue, 11 Nov 2025 01:21:34 +0000
Received: from 1064022179695 named unknown by gmailapi.google.com with HTTPREST; Mon, 10 Nov 2025 20:21:31 -0500
MIME-Version: 1.0 (Mimestream 1.8.3)
References: <176282276721.2054673.8477110870353064546@dt-datatracker-5df8666cb-7l4w5>
In-Reply-To: <176282276721.2054673.8477110870353064546@dt-datatracker-5df8666cb-7l4w5>
From: Christian Kuhtz <christian@kuhtz.com>
Date: Tue, 11 Nov 2025 01:21:34 +0000
X-Gm-Features: AWmQ_bn6ATE1K47gBLlU6zl_-l3oipOvzNWXMSs6GED-Qt7AEA8YetSDCCkORyM
Message-ID: <CABQ4+ik5dh3M6fK4A2zQGw8kGO2Q53hDJeqS7L6MSaVuV3kiSA@mail.gmail.com>
To: Linda Dunbar <linda.dunbar@futurewei.com>
Content-Type: multipart/alternative; boundary="000000000000f2964a0643477758"
Message-ID-Hash: L5RSGFZD5TTL6J2TLB55KECAGNKKOFYR
X-Message-ID-Hash: L5RSGFZD5TTL6J2TLB55KECAGNKKOFYR
X-MailFrom: christian@kuhtz.com
X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; emergency; loop; banned-address; member-moderation; header-match-secdir.ietf.org-0; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header
CC: draft-ietf-rift-kv-tie-structure-and-processing.all@ietf.org, last-call@ietf.org, rift@ietf.org, secdir@ietf.org
X-Mailman-Version: 3.3.9rc6
Precedence: list
Subject: [secdir] Re: draft-ietf-rift-kv-tie-structure-and-processing-05 ietf last call Secdir review
List-Id: Security Area Directorate <secdir.ietf.org>
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/ZiJZ74pIDHMO3Ln5l_AydeYjp84>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Owner: <mailto:secdir-owner@ietf.org>
List-Post: <mailto:secdir@ietf.org>
List-Subscribe: <mailto:secdir-join@ietf.org>
List-Unsubscribe: <mailto:secdir-leave@ietf.org>
On Nov 10, 2025 at 16:59:27, Linda Dunbar via Datatracker <noreply@ietf.org> wrote: > Document: draft-ietf-rift-kv-tie-structure-and-processing > Title: RIFT Key/Value TIE Structure and Processing > Reviewer: Linda Dunbar > Review result: Has Nits > > Overall, the draft is safe but would benefit from a slightly expanded > Security > Considerations section covering input validation, flooding risks, and > confidentiality hygiene. For example, the malicious or malformed KV-TIEs > could > cause unnecessary churn or resource exhaustion. Implementations SHOULD > validate > KV content, discard malformed entries, and log such events. > [..] Hi Linda, Thank you for the review and feedback. Given that https://www.rfc-editor.org/rfc/rfc9692.html#name-security-considerations spells out a good bit of security considerations for the protocol itself and that this draft highlights key-types and their structure carried within the protocol, is this really needed? Thanks, Christian
- [secdir] draft-ietf-rift-kv-tie-structure-and-pro… Linda Dunbar via Datatracker
- [secdir] Re: draft-ietf-rift-kv-tie-structure-and… Christian Kuhtz
- [secdir] Re: draft-ietf-rift-kv-tie-structure-and… Linda Dunbar
- [secdir] Re: [Rift] draft-ietf-rift-kv-tie-struct… Head, Jordan