Re: [secdir] Secdir review of draft-kucherawy-authres-spf-erratum-01

["Murray S. Kucherawy" <[e-mail]>]

Hi Catherine, thanks for your comments.

The language chosen is basically acknowledgement that few if any implementations ever actually used "hardfail".  The error was pointed out not long after RFC5451 was published and all of the implementations I know of did it properly from the beginning.  So the posture is really one of "In case anyone ever did do it the wrong way, ...."

Also, the word "recommended" has specific meaning under RFC2119 and it's my understanding that use of such normative language in Security Considerations ought to be avoided.

Given all that, I'd be fine with saying "implementers are advised" versus "cautious implementers may wish".  I'll add that to the -02 version.

-MSK

From: Catherine Meadows [mailto:[e-mail]]
Sent: Thursday, January 12, 2012 9:25 AM
To: [e-mail]; [e-mail]; [e-mail]
Cc: Catherine Meadows
Subject: Secdir review of draft-kucherawy-authres-spf-erratum-01

This ID is definitely security relevant, as use of the wrong header could
cause a failure to recognize a failed authorization.  Thus in the Security Considerations
section the authors say that "cautious implementers may wish to support both
result strings for some period of time."

One quibble: I believe that the above is good advice, but it seems a little hesitant.  Why the use
of the words "cautious" and "may"?  Why not say that "we recommend that"?  Even if failure
to recognize a failed authorization doesn't lead to any immediate security problem,
it could prevent recognition of a potential attack, or more benignly, of a possible
misconfiguration.


Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]<mailto:[e-mail]>