Re: [secdir] Secdir review of draft-kucherawy-authres-spf-erratum-01

[Catherine Meadows <[e-mail]>]

OK, sounds good!

Cathy


Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]

On Jan 12, 2012, at 12:24 PM, Murray S. Kucherawy wrote:

> -->
> Hi Catherine, thanks for your comments.
> 
>  
> 
> The language chosen is basically acknowledgement that few if any implementations ever actually used “hardfail”.  The error was pointed out not long after RFC5451 was published and all of the implementations I know of did it properly from the beginning.  So the posture is really one of “In case anyone ever did do it the wrong way, ….”
> 
>  
> 
> Also, the word “recommended” has specific meaning under RFC2119 and it’s my understanding that use of such normative language in Security Considerations ought to be avoided.
> 
>  
> 
> Given all that, I’d be fine with saying “implementers are advised” versus “cautious implementers may wish”.  I’ll add that to the -02 version.
> 
>  
> 
> -MSK
> 
>  
> 
> From: Catherine Meadows [mailto:[e-mail]] 
> Sent: Thursday, January 12, 2012 9:25 AM
> To: [e-mail]; [e-mail]; [e-mail]
> Cc: Catherine Meadows
> Subject: Secdir review of draft-kucherawy-authres-spf-erratum-01
> 
>  
> 
> This ID is definitely security relevant, as use of the wrong header could
> 
> cause a failure to recognize a failed authorization.  Thus in the Security Considerations
> 
> section the authors say that "cautious implementers may wish to support both
> 
> result strings for some period of time."
> 
>  
> 
> One quibble: I believe that the above is good advice, but it seems a little hesitant.  Why the use
> 
> of the words "cautious" and "may"?  Why not say that "we recommend that"?  Even if failure
> 
> to recognize a failed authorization doesn't lead to any immediate security problem,
> 
> it could prevent recognition of a potential attack, or more benignly, of a possible
> 
> misconfiguration.  
> 
>  
> 
>  
> 
> Catherine Meadows
> Naval Research Laboratory
> Code 5543
> 4555 Overlook Ave., S.W.
> Washington DC, 20375
> phone: [phone]
> fax: [phone]
> email: [e-mail]
> 
>  
>