[secdir] Secdir review of draft-ietf-idnabis-bidi

[Sam Hartman <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.
Feel free to forward to any appropriate forum.

This document describes a new rule for handling bidirectional
attributes of Unicode characters and the bidirectional text wrapping
algorithm.  I am not qualified to evaluate the security implications
of this draft: I do not understand all the implications, and recommend that the security ADs take a close look.

The draft is well written.  Even given my limited information on the
subject, I found the draft relatively clear--or, at least, clear
enough that I understood some of my gaps.

There is one major deficiency in the security considerations section.
The major attack against naming systems is incorrect mappings; in the
case of DNS mappings used by humans this broadly falls into the
category of phishing or other cases where humans are confused into
thinking they have accessed a desired resource but in fact have
accessed some other resource..  Section 3 discusses several
requirements that could not be met and several confusing situations.
However the security considerations section does not discuss the
security implications of this, or even discuss phishing/confusing
names at all.  I'll give the editors some slack here: I have no idea
what to write either.  However it seems like we should write
something.  I think advice from the security ADs on what level of detail would be desired in the security considerations section of this document would be in order.

I found section 3 particularly useful.  I think it is important than
someone who understands this better than I look at the attacks that
are enabled by the requirements that were considered and rejected to
understand how serious they are.

All in all, this is a great document.