Re: [secdir] SecDir review of draft-ietf-dime-app-design-guide-19

Jouni Korhonen <> Wed, 18 September 2013 13:39 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 3E00C11E82BE; Wed, 18 Sep 2013 06:39:12 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[AWL=0.000, BAYES_00=-2.599]
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id D10E-emxBb6N; Wed, 18 Sep 2013 06:39:11 -0700 (PDT)
Received: from ( [IPv6:2a00:1450:4010:c04::22b]) by (Postfix) with ESMTP id D142311E8287; Wed, 18 Sep 2013 06:39:09 -0700 (PDT)
Received: by with SMTP id u14so6681624lbd.16 for <multiple recipients>; Wed, 18 Sep 2013 06:39:08 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=content-type:mime-version:subject:from:in-reply-to:date:cc :content-transfer-encoding:message-id:references:to; bh=4fr5zhZ3sS45YkTbQNA48JODgP0r3IGhcoDz+55KWao=; b=Ro1/g54fl+fLFni6l/vaXiQrz6MncVEn79a1jwTsOIRvXEeDhCUHywOiIq4HKH5D5o ygXUTUlJ62Rg7xPzx+sWZl5rxAdgVeYOhxC/wuwCD2oMw6fqaOGIjsOlJ8yrSGvEnmLE 0YIbNmLv5c07mwLrZr5O2IletivqrElQxU/oyJp773GsIpsIQ1YV5sa9j0u2ADV4/82Y ibHy+V214kZ3/+XavhYO1xb2x+uiObtZqc+st7OZHe4daSUpYzmg/rm/dmBdsakmyx5v NYbmzWV58P71BWxcEucGhvxu2yi1T7QQMTEww6BmIbCBwZuAIlmd0pczHwuPwqn8HPmh sHoQ==
X-Received: by with SMTP id t2mr34802810lat.1.1379511548598; Wed, 18 Sep 2013 06:39:08 -0700 (PDT)
Received: from [] ([]) by with ESMTPSA id vx8sm1576409lbb.8.1969. (version=TLSv1 cipher=ECDHE-RSA-RC4-SHA bits=128/128); Wed, 18 Sep 2013 06:39:08 -0700 (PDT)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
From: Jouni Korhonen <>
In-Reply-To: <>
Date: Wed, 18 Sep 2013 16:38:56 +0300
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <>
To: Yoav Nir <>
X-Mailer: Apple Mail (2.1510)
Cc: "" <>, The IESG <>, "<>" <>
Subject: Re: [secdir] SecDir review of draft-ietf-dime-app-design-guide-19
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Wed, 18 Sep 2013 13:39:12 -0000

Thanks Yoav,

I'll make sure the authors provide enough reasoning if they intend keeping IKEv1 in the document.

We also try to figure out whether expanding security considerations on the points you mention would be justified within the context of this document.

- Jouni

On Sep 18, 2013, at 2:10 PM, Yoav Nir <> wrote:

> Do not be alarmed.  I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
> Summary: The document is ready for publication
> This informational document provides guidance on extending Diameter applications and on creating new ones. It contains advice such as to re-use existing commands and AVPs, considerations for adding and deleting commands and AVPs, and accounting.
> Section 5.11 talks about Diameter security mechanisms: (D)TLS or IPsec. Some might dislike that it still mentions IKEv1. I'm not sure why this section is necessary at all, as these security mechanisms apply to the base protocol rather than any particular extension.
> There is a 2-page section dealing with registration considerations, but only a very short paragraph for security considerations. That section pretty much says that extensions may be related to security functionality, but the document does not give guidance on enhancing Diameter with respect to security. I agree that this is OK, and new security functionality should specify its own considerations. I do wonder, though, whether it makes sense to include advice about the content in new data and applications as it relates to security, specifically as it relates to data leakage or data aggregation or user privacy.
> Nit:
> Second sentence in the security considerations section:
> OLD:
> Although such an extension may related to security functionality,
> NEW:
> Although such an extension may be related to security functionality,
> Yoav