[secdir] secdir review of draft-groves-megaco-pkgereg-02

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This draft concerns the H.248/MEGACO IANA Package Registration
procedures.  It updates the procedure so that a formal review step,  
since the IETF Megaco
working group, which previously did an informal review, is now  
disbanded.

Since this merely updates the package review process to include a  
formal review, the ID claims
that this introduces no extra security concerns, other than to require  
that the requester of a review
and registration of a package is authorized to do so.  However, I  
wonder if it would be appropriate
to include some language saying that the review process should address  
any potential security
concerns a package may introduce.  I am not an expert on this  
protocol, but  packages appear to be fairly
complex structures that support terminations, which are sources and/or  
sinks. Ambiguity in packages
would be a security concern (possibly allowing spoofing, if I  
understand this correctly);  this
is already covered in the review process recommended in this ID.   I  
would like to see more justification
in the security concerns section that this is the *only* security  
concerned introduced by new packages
before I feel comfortable with this.

The ID says that security concerns for the H.248/MEGACO protocol
are  discussed in H.248.1 section 10.  Note that this itself
appears to be a draft .  Also, it only discusses security in an IP  
setting. That should presumably not be a problem
for the IETF, since that is what we are concerned about, but it should  
still be mentioned, so that the
reader doesn't think that document covers security in general.

Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: 202-767-3490
fax: 202-404-7942
email: catherine.meadows@nrl.navy.mil