Re: [secdir] secdir review of draft-ietf-precis-mappings-11

[Takahiro Nemoto <[e-mail]>]

Dear Mr. Scott:

Thank you for taking your time to review draft-ietf-precis-mappings-11.
We will add a reference to RFC7564 and modify the section 4 "Security Considerations" as following.

4.  Security Considerations

  Detailed security considerations for PRECIS strings are discussed 
  in the PRECIS framework specification [RFC7564].  This document 
  inherits the considerations as well.

  As with Mapping Characters for IDNA2008 [RFC5895], this document
  suggests creating mappings that might cause confusion for some users
  while alleviating confusion in other users.  Such confusion is not
  covered in any depth in this document.

Regards,

--
Takahiro Nemoto
[e-mail]

> 2015/08/04 15:06、Scott G. Kelly <[e-mail]> のメール：
> 
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
> 
> The case and width mappings defined in the current PRECIS (Preparation, Enforcement, and Comparison of Internationalized Strings) framework do not handle other mappings (such as delimiter characters, special characters, and locale-dependent or context-dependent case). This short document aims to provide mapping guidelines for PRECIS profile designers.
> 
> I think this document is probably ready, but I would raise one question (below) for consideration of those more knowledgeable in this area.
> 
> I think the primary security issue with these mappings is that users may misinterpret them (e.g. see "IDN homograph attack" on wikipedia). The security considerations in this document says
> 
>   As with Mapping Characters for IDNA2008 [RFC5895], this document
>   suggests creating mappings that might cause confusion for some users
>   while alleviating confusion in other users.  Such confusion is not
>   covered in any depth in this document.
> 
> This seems a little terse, but it turns out that it matches the security considerations section of RFC5895 nearly word for word.
> 
> My question: should this also include a reference to the security considerations in RFC7564? I leave this to those who know more about 5895, 7564, and PRECIS.
> 
> --Scott
> 
>