Re: [secdir] Secdir review of draft-ietf-mile-enum-reference-format-10

"Zhangdacheng (Dacheng)" <zhangdacheng@huawei.com> Tue, 23 December 2014 06:14 UTC

Return-Path: <zhangdacheng@huawei.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 525F91A00C0; Mon, 22 Dec 2014 22:14:45 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -4.211
X-Spam-Level:
X-Spam-Status: No, score=-4.211 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_MED=-2.3, SPF_PASS=-0.001, T_RP_MATCHES_RCVD=-0.01] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 6UIUPZDHDsUU; Mon, 22 Dec 2014 22:14:43 -0800 (PST)
Received: from lhrrgout.huawei.com (lhrrgout.huawei.com [194.213.3.17]) (using TLSv1 with cipher RC4-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 552011ACD79; Mon, 22 Dec 2014 22:14:43 -0800 (PST)
Received: from 172.18.7.190 (EHLO lhreml402-hub.china.huawei.com) ([172.18.7.190]) by lhrrg01-dlp.huawei.com (MOS 4.3.7-GA FastPath queued) with ESMTP id BQJ32872; Tue, 23 Dec 2014 06:14:41 +0000 (GMT)
Received: from NKGEML402-HUB.china.huawei.com (10.98.56.33) by lhreml402-hub.china.huawei.com (10.201.5.241) with Microsoft SMTP Server (TLS) id 14.3.158.1; Tue, 23 Dec 2014 06:14:41 +0000
Received: from NKGEML507-MBS.china.huawei.com ([169.254.6.3]) by nkgeml402-hub.china.huawei.com ([10.98.56.33]) with mapi id 14.03.0158.001; Tue, 23 Dec 2014 14:14:37 +0800
From: "Zhangdacheng (Dacheng)" <zhangdacheng@huawei.com>
To: "Adam W. Montville" <adam.w.montville@gmail.com>
Thread-Topic: [secdir] Secdir review of draft-ietf-mile-enum-reference-format-10
Thread-Index: AQHQFCyAVFkOFbI4vE6cR42dFpdb55yLsAOAgBEW1ZA=
Date: Tue, 23 Dec 2014 06:14:36 +0000
Message-ID: <C72CBD9FE3CA604887B1B3F1D145D05EA9DF4C9E@nkgeml507-mbs.china.huawei.com>
References: <6BAB7B9A-1A70-4957-ADC2-1836F22A4219@cisco.com> <C72CBD9FE3CA604887B1B3F1D145D05EA9DEAB78@nkgeml507-mbs.china.huawei.com> <6A8E604C-DC8C-410E-A2F4-79B401FD0515@gmail.com>
In-Reply-To: <6A8E604C-DC8C-410E-A2F4-79B401FD0515@gmail.com>
Accept-Language: zh-CN, en-US
Content-Language: zh-CN
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [10.111.98.139]
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: base64
MIME-Version: 1.0
X-CFilter-Loop: Reflected
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/oDSJToIz694UPdiO9xBThfx4hc4
Cc: The IESG <iesg@ietf.org>, "draft-ietf-mile-enum-reference-format.all@tools.ietf.org" <draft-ietf-mile-enum-reference-format.all@tools.ietf.org>, "secdir@ietf.org" <secdir@ietf.org>
Subject: Re: [secdir] Secdir review of draft-ietf-mile-enum-reference-format-10
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 23 Dec 2014 06:14:45 -0000

Hi, Adam:

Thanks a lot for your reply. I have no additional comments now.

Cheers

Dacheng
> -----Original Message-----
> From: Adam W. Montville [mailto:adam.w.montville@gmail.com]
> Sent: Saturday, December 13, 2014 1:16 AM
> To: Zhangdacheng (Dacheng)
> Cc: secdir@ietf.org; The IESG;
> draft-ietf-mile-enum-reference-format.all@tools.ietf.org
> Subject: Re: [secdir] Secdir review of draft-ietf-mile-enum-reference-format-10
> 
> Hi Dacheng,
> 
> Thank you for your review…responses inline.
> 
> Adam
> 
> > On Dec 9, 2014, at 9:50 PM, Zhangdacheng (Dacheng)
> <zhangdacheng@huawei.com> wrote:
> >
> > I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These
> comments were written primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments just like any
> other last call comments.
> >
> > This document is establishing a container for publicly available enumeration
> values to be included in an IODEF [IODEF] document. Several questions about
> the proposed solution are listed as follows.
> > 1)	In this specification, a given enumeration is uniquely identified by the
> specIndex attribute. However the usage of ID is not clearly introduced. In the
> security consideration section, it is mentioned that the miss-match between
> the index and the ID may cause problem. Could you please give me some clues?
> 
> The enumeration specification is identified, so that the ID expressed in a given
> IODEF (note v2 not v1) is understood.  The ID is a reference to a set of further
> information to be acquired through other means.  As an example, discovered
> vulnerabilities are often given a Common Vulnerability Enumeration (CVE)
> identifier.  This ID would be in the <iodef:enum:ID> element, and the
> specification for that ID’s format is what is pointed to by the IANA registry.
> 
> 
> > 2)	Where is section 2.2?
> 
> Good catch, thank you.
> 
> > 3)	In the abstract, it is stated that "This memo establishes a stand-alone
> data format to include both the external specification and specific enumeration
> value,. However, I didn't find the specific enumeration value in the example
> provided in Section 2.1:
> > "      <iodef:Reference>
> >         <iodef-enum:ReferenceName specIndex="1">
> >            <iodef-enum:ID>CXI-1234-XYZ</iodef-enum:ID>
> >         </iodef-enum:ReferenceName>
> >         <iodef:URL>http://cxi.example.com</iodef:URL>
> >         <iodef:Description>Foo</iodef:Description>
> >      </iodef:Reference>
> > “
> 
> That sentence should probably read (emphasis added): This memo establishes
> a stand-alone data format to include both the external specification and
> specific enumeration *identification* value.
> 
> > Cheers
> >
> > Dacheng
> >
> > _______________________________________________
> > secdir mailing list
> > secdir@ietf.org
> > https://www.ietf.org/mailman/listinfo/secdir
> > wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview