Re: [secdir] SecDir review of draft-ietf-calsify-2446bis-09

[Yaron Sheffer <[e-mail]>]

Hi Cyrus,

[removing IESG].

Thanks for accepting my review. Please see my remaining responses inline.

Thanks,
	Yaron

> -----Original Message-----
> From: Cyrus Daboo [mailto:[e-mail]]
> Sent: Tuesday, September 22, 2009 18:35
> To: Yaron Sheffer; secdir; [e-mail]; draft-ietf-calsify-
> [e-mail]
> Subject: Re: SecDir review of draft-ietf-calsify-2446bis-09
> 
> Hi Yaron,
> Thank you for your review.
> 
> --On September 21, 2009 9:02:17 AM +0300 Yaron Sheffer
> <[e-mail]> wrote:
> 
> > Reality Check
> >
> >
> >
> > If basing the entire security of the protocol on S/MIME may have been
> > reasonable in 1998, today this is almost meaningless. S/MIME is too
> > rarely used to protect mail in transit, and I would imagine its use to
> > protect calendaring is even less prevalent.
> 
> This is a good point. In fact with CalDAV we are doing iTIP scheduling
> over
> HTTP with SSL and S/MIME is not involved at all. Given Eliot's comment
> about the nature of iTIP (i.e. transport independence) at this point it
> may
> be best to remove the explicit MUST for S/MIME.
> 
[YS] Well in fact, having read the first paragraph of Sec. 15 of CalDAV, I would recommend that you add more depth to your use of SSL. Just saying "Servers and clients MUST use an HTTP connection protected with TLS as defined in [RFC2818] for all scheduling transactions" will not give you the security that you need. Things like how clients are authenticated, and what fields in the calendar objects must match which certificate fields.

> Proposal:
> 
> Section 6.2: remove the sentence:
> 
>    This may be accomplished using
>    public key technology, specifically Security Multiparts for MIME
>    [RFC1847] in the iTIP transport binding.
> 
> Section 6.2.1: change title to: "Securing iTIP transactions"
> 
> Change first sentence to:
> 
>    iTIP transport bindings MUST provide a mechanism to enable
> authentication of the
>    sender's identity, and privacy and integrity of the data being
>    transmitted.
> 
> The reference to 1847 would be removed entirely.


[YS] If there are still bindings that do use S/MIME, you might want to have "if S/MIME is used to provide these assurances..." and the rest of the existing subsection.
> 
> > Security
> >
> >
> >
> > - In Sec. 6.2, replace "encrypted" by "encrypted and
> > authenticated".
> 
> Fixed in my working copy.
> 
> > - An attack that is never mentioned is unauthorized creation of events.
> 
> > In many enterprise situations not everyone is authorized to invite the
> > CEO, for example. Similarly, there may be tight control over who is
> > allowed to delegate to whom. This obviously calls for an access control
> > mechanism, something that is never mentioned in the document.
> 
> Good point. In CalDAV scheduling
> (<http://tools.ietf.org/html/draft-desruisseaux-caldav-sched>) we have in
> fact used WebDAV ACL with a new set of privileges to allow just that. This
> actually goes a little beyond just access control. For example, with iMIP
> (email) there is no way to prevent someone from sending an iMIP message to
> someone else. In that case email filtering needs to be used to enforce
> restrictions. Whilst the specific details of how all that should work
> depends on the transport, something does need to be said in this document.
> Therefore I propose adding the following:
> 
> 6.2.3 Access Controls and Filtering
> 
>     In many environments there could be restrictions on who is allowed to
>     scheduled with whom, and who allowed delegates are for particular
>     calendar users.
> 
>     iTIP transport bindings SHOULD provide mechanisms for implementing
>     access controls or filtering to ensure iTIP transactions only take
>     place between authorized calendar users. That would include preventing
>     one calendar user from scheduling with another, or a calendar user
>     delegating to another.
[YS] Sounds good.
> 
> 
> 
> > Nits
> >
> >
> >
> > - 1.4: in table, objecy -> object
> >
> > - 3.2.5 and 3.4.5: is MUST -> MUST
> 
> Both fixed in my working copy.
> 
> --
> Cyrus Daboo
> 
> 
> Scanned by Check Point Total Security Gateway.

Email secured by Check Point

Email secured by Check Point