Re: [secdir] Writing Security Considerations

Hi, Vincent.

Thanks, but I don’t know what kind of lesson there is in this for the general RFC-writing audience.

Always call out when you have internal length fields because that can be done dangerously in C?

I think mis-handling length fields has been an issue with protocols as long as protocols have been implemented.

Yoav

> On 26 Jun 2019, at 9:57, Vincent Roca <vincent.roca@inria.fr> wrote:
> 
> Hello Yoav and Linda,
> 
> Good initiative.
> 
> Since you’re looking for stories, here is a proposal, rooted in real life.
> RFC6520 (https://tools.ietf.org/html/rfc6520 <https://tools.ietf.org/html/rfc6520>) on TLS heartbeat extension has a pretty simple security considerations section: it says 
> it does not introduce any new security consideration and it refers to two existing RFCs.
> 
> We all know this TLS heartbeat extension has been the cause of the famous heartbleed OpenSSL vulnerability and associated attack.
> Of course the major problem comes from an erroneous implementation of the mechanism in OpenSSL:
> https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3 <https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=96db9023b881d7cd9f379b0c154650d6c108e9a3>
> 
> The goal is not to blame anybody in person, especially as the RFC describes what should be done to prevent any problem.
> But I also think this is a document where we all (i.e., authors/secdir/IESG) should have highlighted the associated risk of badly
> implementing the response message in the Security Considerations section. As always in such a situation, it’s easier to say afterwards!
> 
> I think there is a way to say that in a positive way (lessons learned) and tell an interesting story many people heard about without knowing
> the details.
> 
> Cheers,
> 
>   Vincent
> 
> 
>> Le 25 juin 2019 à 20:57, Yoav Nir <ynir.ietf@gmail.com <mailto:ynir.ietf@gmail.com>> a écrit :
>> 
>> Hi, all
>> 
>> If you’ve had a look at the draft agenda (https://datatracker.ietf.org/meeting/105/agenda.html <https://datatracker.ietf.org/meeting/105/agenda.html>), we have a Writing Security Considerations tutorial on Sunday, which Linda Dunbar and I will be doing.
>> 
>> The idea is to get people writing drafts to know what they should do for a smooth interaction with us SecDir people.
>> 
>> The slides do not exist yet, but we have a rough outline on github: https://github.com/IETF-SAAG/SecurityConsiderationsTutorial <https://github.com/IETF-SAAG/SecurityConsiderationsTutorial>
>> 
>> So if there’s missing or wrong stuff, we’d like to hear about it, preferably in the form of PRs.
>> 
>> But most of all, we’re looking for more examples in the examples page: https://github.com/IETF-SAAG/SecurityConsiderationsTutorial/blob/master/examples.md <https://github.com/IETF-SAAG/SecurityConsiderationsTutorial/blob/master/examples.md>
>> 
>> So any horror story, war story, stuff that’s terribly wrong, or even something that’s surprisingly right will be welcome.
>> 
>> Thanks in advance
>> 
>> Linda & Yoav
>> 
>> _______________________________________________
>> secdir mailing list
>> secdir@ietf.org <mailto:secdir@ietf.org>
>> https://www.ietf.org/mailman/listinfo/secdir
>> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview
> 