Re: [secdir] Security review of draft-hodges-webauthn-registries-05

[Roman Danyliw <[e-mail]>]

Hi Hilarie, thank you for this review.  

Hi Mike, thank you for incorporating the feedback.  

I entered a No Objection ballot.

Regards,
Roman

> -----Original Message-----
> From: iesg <[e-mail]> On Behalf Of Mike Jones
> Sent: Thursday, May 14, 2020 4:43 PM
> To: Hilarie Orman <[e-mail]>; [e-mail]
> Cc: [e-mail]; [e-mail];
> [e-mail]
> Subject: RE: Security review of draft-hodges-webauthn-registries-05
> 
> The duplicate URI has been removed from https://tools.ietf.org/html/draft-
> hodges-webauthn-registries-07#section-6.2.  We should be good to go now!
> 
> 				Thanks again,
> 				-- Mike
> 
> -----Original Message-----
> From: Mike Jones
> Sent: Thursday, May 14, 2020 11:34 AM
> To: Hilarie Orman <[e-mail]>
> Cc: [e-mail]; [e-mail]; [e-mail]; draft-hodges-webauthn-
> [e-mail]
> Subject: RE: Security review of draft-hodges-webauthn-registries-05
> 
> Oh, I see what you mean now.  I didn't realize that the tool wouldn't coalesce
> multiple instances of the same URI to a single reference.  I'll do something to
> eliminate the duplication now.
> 
> 				Thanks again,
> 				-- Mike
> 
> -----Original Message-----
> From: Hilarie Orman <[e-mail]>
> Sent: Thursday, May 14, 2020 10:23 AM
> To: Mike Jones <[e-mail]>
> Cc: [e-mail]; [e-mail]; [e-mail]; draft-hodges-webauthn-
> [e-mail]
> Subject: RE: Security review of draft-hodges-webauthn-registries-05
> 
> The only nit, then, is that the URI was listed twice in section 6.2.  It is listed in
> entry 6 and entry 9.
> 
> Hilarie
> 
> >  Thanks for the review, Hilarie.  My replies are inline below, prefixed by
> "Mike>".
> 
> >  -----Original Message-----
> >  From: Hilarie Orman <[e-mail]>
> >  Sent: Monday, April 27, 2020 9:42 PM
> >  To: [e-mail]; [e-mail]
> >  Cc: [e-mail]
> >  Subject: Security review of draft-hodges-webauthn-registries-05
> 
> >	  Security review of Registries for Web Authentication
> >		  draft-hodges-webauthn-registries-05
> 
> >  Do not be alarmed.  I generated this review of this document as part of the
> security directorate's ongoing effort to review all IETF documents being
> processed by the IESG.  These comments were written with the intent of
> improving security requirements and considerations in IETF drafts.  Comments
> not addressed in last call may be included in AD reviews during the IESG review.
> Document editors and WG chairs should treat these comments just like any
> other last call comments.
> 
> >  This document establishes two registries required for the W3C Web
> Authentication system.  The registries are for the WebAuthn Attestation
> Statement Format Identifier and the WebAuthn Extension Identifier.
> 
> >  When submitted, these entries must be approved by an "expert" based on
> the specification that defines the parameters of the entry.  This includes
> "security considerations", which is good.  I don't quite see how submission of a
> request for a new entry gets routed to an expert, how experts come into being,
> etc., but I suppose that is a W3C procedure.
> 
> >  A couple of nits.
> 
> >  This url is listed twice in the URIs:
> >  https://www.iana.org/assignments/webauthn
> >  but it does not exist.  I expected at least a TBD message, unless the address
> itself is a placeholder.
> 
> >  Mike> The draft includes this TBD text "[[ Per discussions in an email thread
> between the authors and IANA ( "[IANA #1154148]" ), it is requested that the
> registries be located at <https://www.iana.org/assignments/webauthn>. RFC
> Editor - please delete this request after the registries have been created. ]]"
> before the two occurrences that you cite.
> 
> >  In 2.1
> >  "The Experts(s) MAY also designate attestation
> >     statement formats as proprietary if they lack complete
> >     specifications, and will assign a prefix indicating as such to the
> >     identifier."
> >  It is not clear what the format of that prefix is or how indicates "as such".  Is
> that an indication that it is proprietary or (and?) that it is incomplete?
> 
> >  Mike>  The text you cited is unnecessary for the purposes of the specification
> and will be deleted.
> 
> >  Hilarie
> 
> >  Mike> You can see proposed updated source for -06 at
> https://github.com/w3c/webauthn/pull/1415 .
> 
> >				   Thanks again,
> >				   -- Mike