[secdir] secdir review of draft-ietf-dmm-4283mnids-04

Joseph Salowey <joe@salowey.net> Sun, 05 February 2017 22:37 UTC

Return-Path: <joe@salowey.net>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id F15C3129A23 for <secdir@ietfa.amsl.com>; Sun, 5 Feb 2017 14:37:21 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.6
X-Spam-Level:
X-Spam-Status: No, score=-2.6 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=salowey-net.20150623.gappssmtp.com
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yA9hMB4BwwTr for <secdir@ietfa.amsl.com>; Sun, 5 Feb 2017 14:37:19 -0800 (PST)
Received: from mail-oi0-x236.google.com (mail-oi0-x236.google.com [IPv6:2607:f8b0:4003:c06::236]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id CDFAC129A1E for <secdir@ietf.org>; Sun, 5 Feb 2017 14:37:16 -0800 (PST)
Received: by mail-oi0-x236.google.com with SMTP id w204so38692890oiw.0 for <secdir@ietf.org>; Sun, 05 Feb 2017 14:37:16 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=salowey-net.20150623.gappssmtp.com; s=20150623; h=mime-version:from:date:message-id:subject:to; bh=m9Zw7GBbGbmGfZKAiue3DgWbHLJp/3P9bZD1zpOKDZk=; b=JwozVrfOhlergza5szLo3lcMnzWXmHHzFE0nBoKGNsNoCNzzAKGmadoeifwj6tnz8W vRodoqm3FW+TM4FMsbmzVcITAFZLE+Woz2SmrCc5GaEY10INsO7JoIYlnBZvlkAMIRTH j8l2gh6mAqGIjQL4aQWCns9onc/JnulYT40dfJ1zwgMWVuqEElTC6DjD9hbMm0sW/hH8 sGjk/PnMsNRqhLvCtRbsffxaa1nLNc0B2Bs0a6zyNMnYxmu3+CBGGwhVEQFTy5vLuXRc eOffk00gfv1v4MQ29JDGY6ROmhs57xl6+gJq4iWgDAW8wDmVzTyxYEKQoi7UHaGVTlDM onkQ==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=m9Zw7GBbGbmGfZKAiue3DgWbHLJp/3P9bZD1zpOKDZk=; b=d4cRRFowNvoRjPfilXooxAMcU8rMzVimoUXDjWX+PhHlJyI9Yqfw2Oj/upXBSR+F/E /LH0sEo2cw/3tkjeK3c5z/kq2f3PmsF7Zck7uIFnIvlfOIMldHWKnu+epETeaVZHlFt9 wi7RZYCZvZ1AfymcIJPCk88Yzz23Ee3gLuoEvPC0vZDFdMJL3hX5rvQyngGDFoPoevFS rSD7vYD76hwdeYqcEZPLsv85AtWVBwTC1m7GqX3TbyNalvq+CvtBuWblZvsrWhN1X851 Zvh/J1Qhd/K96t03Mh0ASS49TQ+OkFfNytpD4Se5QXJCyTLxrs+5boxgPtilqDPZ7Frs v6Ow==
X-Gm-Message-State: AMke39lBCtOsnVKHSEvUVvDmxw9hNlDZEMNepLa7sjVus8ay9NshC9FcNrTPb9oJFe6KaZkRulFJbMK1o3oIOQ==
X-Received: by 10.202.178.11 with SMTP id b11mr3923877oif.101.1486334236046; Sun, 05 Feb 2017 14:37:16 -0800 (PST)
MIME-Version: 1.0
Received: by 10.74.51.201 with HTTP; Sun, 5 Feb 2017 14:36:55 -0800 (PST)
From: Joseph Salowey <joe@salowey.net>
Date: Sun, 5 Feb 2017 14:36:55 -0800
Message-ID: <CAOgPGoA32_AeYwbrEze52Hghd50Q-0svYojbpaMAb_LuiVCW4w@mail.gmail.com>
To: secdir <secdir@ietf.org>, draft-ietf-dmm-4283mnids.all@ietf.org, The IESG <iesg@ietf.org>
Content-Type: multipart/alternative; boundary=001a113cd284284bbf0547d02863
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/sd3NsJNKdfK-e-j9TncWtZFRNq0>
Subject: [secdir] secdir review of draft-ietf-dmm-4283mnids-04
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 05 Feb 2017 22:37:22 -0000

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This document is ready with nits.

I was pleased that the security considerations does discuss some privacy
issues.  I think it would help to emphasize that identifiers can be
trackable since many of the IDs in the draft are long lived.  The section
does mention it, this suggestion is just for emphasis.

First sentence of second paragraph of security considerations.

"Some identifiers (e.g., IMSI) are considered to be private information and
some are long lived allowing for tracking of an individual or device."

Cheers,

Joe