[secdir] Review of draft-ietf-nfsv4-rfc1831bis-10

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat 
these comments just like any other last call comments.

This draft describes clarifications to the the Remote Procedure Call 
(RPC) Version 2 protocol.  The draft does not specify any change of bits 
over-the-wire, but rather clarifies aspects for IANA registry, 
implementation, and authentication.

The security consideration section does exist and discusses 
recommendations on which security flavors should be used according to 
the service in question.  I think that this is sufficient for this 
particular draft and that the informative reference discusses the 
security implications for the respective security flavors.

I'm not suggesting to address this here, not by any means, but verifiers 
could also be useful in some cases in reply messages that are not 
accepted by the server.  This is useful when preventing a DoS attack on 
clients.  It would be up to the GSS mechanism to determine how to do 
this if at all possible.

Editorial comment(s):

s/them in future/them in the future/
s/minimum, the/a minimum, the/
s/in future/in the future/
s/to used on/to be used on/

Shawn.
--
_______________________________________________
secdir mailing list
secdir@ietf.org
https://www.ietf.org/mailman/listinfo/secdir