[secdir] Recurring issues found during sec review

Roman Danyliw <rdd@cert.org> Tue, 23 July 2019 13:46 UTC

Return-Path: <rdd@cert.org>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 91AC8120300 for <secdir@ietfa.amsl.com>; Tue, 23 Jul 2019 06:46:45 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.999
X-Spam-Level:
X-Spam-Status: No, score=-1.999 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cert.org
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id GrvqqrTi9dGo for <secdir@ietfa.amsl.com>; Tue, 23 Jul 2019 06:46:43 -0700 (PDT)
Received: from veto.sei.cmu.edu (veto.sei.cmu.edu [147.72.252.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id A8B4C1202A4 for <secdir@ietf.org>; Tue, 23 Jul 2019 06:46:43 -0700 (PDT)
Received: from korb.sei.cmu.edu (korb.sei.cmu.edu [10.64.21.30]) by veto.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6NDkgLM023298 for <secdir@ietf.org>; Tue, 23 Jul 2019 09:46:42 -0400
DKIM-Filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu x6NDkgLM023298
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cert.org; s=yc2bmwvrj62m; t=1563889602; bh=IUonLG6gcfBA++KpPkhYPR9OGgKeHguIETbtij3sPTM=; h=From:To:Subject:Date:From; b=kKGhTT5jJJtRiJqum04l1J2cJghkI46HjooBVyq/IsBiJANlKBQOJ7M7/aTxzcZxB fff5B/sfRkxyIZhfEcdx5Ft2iMDCBFf5prx0RtiEpgdLJuMwjUY78yKoYJKC+cSUCE PxTE05OdP1nYXgZBqPJoAAvR+UIGRMc8yn02DKYU=
Received: from CASCADE.ad.sei.cmu.edu (cascade.ad.sei.cmu.edu [10.64.28.248]) by korb.sei.cmu.edu (8.14.7/8.14.7) with ESMTP id x6NDkb16029996 for <secdir@ietf.org>; Tue, 23 Jul 2019 09:46:37 -0400
Received: from MARCHAND.ad.sei.cmu.edu ([10.64.28.251]) by CASCADE.ad.sei.cmu.edu ([10.64.28.248]) with mapi id 14.03.0439.000; Tue, 23 Jul 2019 09:46:37 -0400
From: Roman Danyliw <rdd@cert.org>
To: secdir <secdir@ietf.org>
Thread-Topic: Recurring issues found during sec review
Thread-Index: AdVBXOvbIZa03j1BSj2dTFwg8FntWA==
Date: Tue, 23 Jul 2019 13:46:37 +0000
Message-ID: <359EC4B99E040048A7131E0F4E113AFC01B33E17EA@marchand>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.64.22.6]
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/jTfjb-EbWGVtCPzoklqEqYLBxuw>
Subject: [secdir] Recurring issues found during sec review
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.29
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Jul 2019 13:46:56 -0000

Hi!

As an IESG initiatives, each of the areas is pulling together a list of "recurring issues" found by their areas during area review (e.g., secdir, iotdir, genart, opsdir, tsvart) and IESG review.  The intent is to provide informal, but not comprehensive, guidance to draft authors and their WG chairs with the intent to find issues earlier.  Ben and I made the following initial list:

https://trac.ietf.org/trac/sec/wiki/TypicalSECAreaIssues

Welcome feedback and refinement!

Regards,
Roman and Ben