Re: [secdir] secdir review of draft-ietf-precis-7700bis-07

[Daniel Migault <[e-mail]>]

Thanks for the response. It addresses my comment.  

My comment was motivated by re-using an example developed in the document to illustrate that mapping rules needs to be coordinated with the other security considerations. However, for some reasons, I missed that the capital letter of GREEK SMALL LETTER FINAL SIGMA and GREEK SMALL LETTER SIGMA are "similar" because it is the same Unicode character. I apology for the confusion.

I agree with you that the CYRILLIC SMALL LETTER A vs. LATIN SMALL LETTER A  example is not needed. 

Thanks for the response!

Yours, 

Daniel
-----Original Message-----
From: Peter Saint-Andre - Filament [mailto:[e-mail]] 
Sent: Friday, June 09, 2017 4:09 PM
To: Daniel Migault <[e-mail]>; [e-mail]
Cc: The IESG <[e-mail]>; [e-mail]
Subject: Re: secdir review of draft-ietf-precis-7700bis-07

Hi Daniel, thanks for the review. Comments inline.

On 6/9/17 11:04 AM, Daniel Migault wrote:
> Hi,
> 
> I have reviewed this document as part of the security directorate's 
> ongoing effort to review all IETF documents being processed by the 
> IESG.  These comments were written primarily for the benefit of the 
> security area directors.  Document editors and WG chairs should treat 
> these comments just like any other last call comments.
> 
> The summary of the review is READY
> 
> 
> nits:
> 
> COMMENT A)
> 
> """
> 2.1.  Rules
> 
>    The following rules apply within the Nickname profile of the PRECIS
>    FreeformClass.
> """
> 
> I might be helpful to add the reference to RFC7564 after the 
> FreeformClass as you did in section 2.2. Another way could also to 
> assume in the introduction the reader is familiar with RFC7564. I also 
> agree RFC7564 is mentioned in the terminology section.

It can't hurt to reference RFC 7564 here, too.

> COMMENT B)
> 
> """  
>  4.  Normalization Rule: Apply Unicode Normalization Form KC.  Because 
> """
> 
> Two unexpected white spaces. Can be fixed by rfc-editor
> 
> COMMENT C)
> 
> """
> 6.  Security Considerations
> 
> 6.3.  Visually Similar Characters
> """
> 
> Maybe a reference to the example section with the names 5/7 or 6/7 can 
> illustrate that the current profile does not prevent visually similar 
> characters.

Well, those characters aren't visually similar. Section 12.5 of rfc7546bis talks about this in detail; although it does provide some examples, it might help to add more (e.g., CYRILLIC SMALL LETTER A
U+0430 vs. LATIN SMALL LETTER A U+0061).

Peter

--
Peter Saint-Andre
https://filament.com/
[phone]