[secdir] SecDir review of draft-ietf-ecrit-car-crash-20

["Xialiang (Frank)" <[e-mail]>]

Hello,
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document describes how to use IP-based emergency services mechanisms to support the next generation of emergency calls placed by vehicles and conveying vehicle, sensor, and location data related to the crash or incident. Comparing to the ECRIT basic drafts [draft-ietf-ecrit-ecall] [RFC7852], this extension draft mostly reuses the same technical aspects of the basic drafts, with the introduction of some new things: a new set of vehicle (crash) data -- the Vehicle Emergency Data Set (VEDS), new attribute values to the metadata/control object, a new SIP INFO package of the VEDS MIME type, etc.

Since most technical aspects of this draft are unchanged from the basic drafts, all the security considerations in them apply for this draft well. The security consideration in [RFC5069] applies for this draft too. And these basic drafts already have very comprehensive and detailed considerations about privacy and security threats. Regarding the new introduced data and action values, this draft discusses the general security mechanisms to protect their CIA (e.g., certificate, encryption, ...) too. In Summary, I have no more security issues.

Summary: this document appears in reasonably good shape, and is written well. I think it is ready.

Thanks!
B.R.
Frank