Content-Type: text/plain;
	charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.7\))
From: Carsten Bormann <cabo@tzi.org>
In-Reply-To: <171681904824.4732.13257098186796399236@ietfa.amsl.com>
Date: Wed, 3 Jul 2024 22:13:52 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <C0005A9A-8878-47F7-8CB0-01C8F825A8AC@tzi.org>
References: <171681904824.4732.13257098186796399236@ietfa.amsl.com>
To: Rifaat Shekh-Yusef <rifaat.s.ietf@gmail.com>
Message-ID-Hash: V5WUMCHHAJB36ROQNTSZGYGXPZOPEC33
CC: secdir@ietf.org, cbor@ietf.org, draft-ietf-cbor-edn-literals.all@ietf.org,
 last-call@ietf.org
Precedence: list
Subject: =?utf-8?q?=5Bsecdir=5D_Re=3A_=5BCbor=5D_Secdir_last_call_review_of_draft-iet?=
	=?utf-8?q?f-cbor-edn-literals-09?=
Archived-At: 
 <https://mailarchive.ietf.org/arch/msg/secdir/cxrjQS92GItUZG4G7-NBHqcfE7I>

On 2024-05-27, at 16:10, Rifaat Shekh-Yusef via Datatracker =
<noreply@ietf.org> wrote:
>=20
> This document describes how to add application specific extensions to =
EDN. The
> security section of this draft does not discuss the implication of =
this
> directly, but instead points to RFC8610 and RFC8949. Because, as =
stated above,
> these diagnostics are not meant to be parsed, this document implies =
that there
> are no new security implications associated with these new extensions.
>=20
> If this is the case, it would be nice to add a sentence or two to help =
the
> reader get to this conclusion directly, instead of just pointing the =
reader to
> the other documents.

Hi Rifaat,

thank you for pointing out this gap.
Extensions exercising these extension points can very well have their =
own security considerations, as exemplified already by the next two =
application-extensions in the pipeline, e=E2=80=99=E2=80=99 and =
ref=E2=80=99=E2=80=99 [1].

[1]: =
https://www.ietf.org/archive/id/draft-ietf-cbor-edn-e-ref-00.html#name-sec=
urity-considerations

We added some text about this in PR #50 [50], explaining how tool =
implementers and operators may need to be considerate of security =
implementations posed by the extensions they support.

[50]: https://github.com/cbor-wg/edn-literal/pull/50/files

This PR is merged and slated to be part of the next revision =
draft-ietf-cbor-edn-literal-10.

Gr=C3=BC=C3=9Fe, Carsten