Re: [secdir] secdir review of draft-ietf-calext-extensions-03

[Cyrus Daboo <[e-mail]>]

Hi Xialiang,
Thank you for your review. Fixes described below have been made to my 
working copy and will be included in the next published draft.

--On June 22, 2016 at 1:39:06 AM +0000 "Xialiang (Frank)" 
<[e-mail]> wrote:

> Below is a series of my comments, nits for your consideration.
>
> comments:
> section 7
> 1. This section covers the possible new threats brought by new properties
> and parameters, but does not mention how to mitigate them explicitly.
> Could you consider this point?

I've added some additional text to my working copy to cover that.

> 2. The "Security Considerations" section
> of [RFC5545] describes the general security issues and its corresponding
> relation with the transport protocol. It's clear and comprehensive. As
> the extension draft to the iCalendar object specification, it's a good
> practice to mention that the security considerations in [RFC5545]
> continue to apply in this document.

I have added the follow text as the last paragraph of Security 
Considerations:

    Security considerations in [RFC5545], and [RFC5546] MUST also be
    adhered to.

I have also added a Privacy Considerations section with similar text.

Also, on further review there were a couple of addition items I felt needed 
to be added to these sections. In particular text about short 
REFRESH-INTERVALs being used to trigger denial of service attacks.

> section 5.2--5.6
> These sections specify the extensive properties, and don't follow the
> template in [RFC5545]. Would it be better to have some text for each
> extensive property to point out its original specification in [RFC5545]
> for easy understanding?

OK. I have added text in each of those sections providing a reference back 
to the section in RFC5545 where the original definitions reside.

> section 5.11
> The new property -- conference, is missed in the previous iCalendar
> components' definition in section 4;

Fixed.

> nits:
> Section 8.1
> The section number of [RFC5545] referenced here is wrong, it should be
> modified from 8.2.3 to 8.3.2;
>
> Section 8.2
> The section number of [RFC5545] referenced here is wrong, it should be
> modified from 8.2.4 to 8.3.3;

Fixed.

-- 
Cyrus Daboo