Re: [secdir] secdir review of draft-ietf-tzdist-service-09

Joseph Salowey <joe@salowey.net> Sun, 05 July 2015 19:08 UTC

Return-Path: <joe@salowey.net>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (ietfa.amsl.com [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 8D1421ACDEA for <secdir@ietfa.amsl.com>; Sun, 5 Jul 2015 12:08:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.722
X-Spam-Level:
X-Spam-Status: No, score=0.722 tagged_above=-999 required=5 tests=[BAYES_50=0.8, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham
Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id xya4v8BCjEjk for <secdir@ietfa.amsl.com>; Sun, 5 Jul 2015 12:08:56 -0700 (PDT)
Received: from mail-qk0-f181.google.com (mail-qk0-f181.google.com [209.85.220.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C02861ACDE5 for <secdir@ietf.org>; Sun, 5 Jul 2015 12:08:55 -0700 (PDT)
Received: by qkeo142 with SMTP id o142so104964226qke.1 for <secdir@ietf.org>; Sun, 05 Jul 2015 12:08:55 -0700 (PDT)
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:mime-version:in-reply-to:references:date :message-id:subject:from:to:cc:content-type; bh=xP1uwdyQYJ/IrUdwSQ6S2rL+CzXqJ/i5cOd8LdNhtXE=; b=l3C2N8d5EClJzy8cQG/i+6AMXgV6kJ06G5SMdCiNGnkL8nk8H87Y1nl7He7w//qnMP zng3GGufAn6KmjQiz5+DdhcnDrOC9sbasihE5NWE6okJmtAdGJJa48I9D1p1jgPjezsD eQwMtP+KiLfTh/HzwIfRWTSow7q61Jj/A+AC6SbI9T9jLWrMmsc8IgS9kHgENzoLELSz tCD7nuobgQp5b6uCiVbzGG52GNlLJ3OQkh+Gr7qQAwb4dagIzG7joSpddY2kU6Ghkjqh np1U3Sp6nJ44cW4YtBloNanxA5vqZP7D6QX+aW6p4dXMo24br9t5Bntyj11URNQkNLj6 7omg==
X-Gm-Message-State: ALoCoQm1ZMD04RSR7nFFwYXcrart5C8lCWz3ewAtIBHZHK+pCgaysSBh6O1WN0FlqrP6c8yG9arl
MIME-Version: 1.0
X-Received: by 10.140.104.147 with SMTP id a19mr68394425qgf.71.1436123335033; Sun, 05 Jul 2015 12:08:55 -0700 (PDT)
Received: by 10.96.161.169 with HTTP; Sun, 5 Jul 2015 12:08:54 -0700 (PDT)
In-Reply-To: <5594D2BE.8000105@cisco.com>
References: <CAOgPGoAOvUTOPBSWjzt7Boh7Lgos2FgO9BmmwMZyBVQd=aB04w@mail.gmail.com> <5594D2BE.8000105@cisco.com>
Date: Sun, 5 Jul 2015 12:08:54 -0700
Message-ID: <CAOgPGoATM99s2OPb_dsMzt5O2Zdmg--vZAE_kCSpJeguMOoQKA@mail.gmail.com>
From: Joseph Salowey <joe@salowey.net>
To: Eliot Lear <lear@cisco.com>
Content-Type: multipart/alternative; boundary=001a1134f58e3d2d84051a2585d2
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/yDqw5gpZodN7_r8AxGhn27FzHvw>
Cc: draft-ietf-tzdist-service.all@tools.ietf.org, The IESG <iesg@ietf.org>, secdir <secdir@ietf.org>
Subject: Re: [secdir] secdir review of draft-ietf-tzdist-service-09
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Sun, 05 Jul 2015 19:08:57 -0000

On Wed, Jul 1, 2015 at 10:57 PM, Eliot Lear <lear@cisco.com> wrote:

>  Hi Joe,
>
> On 7/2/15 7:19 AM, Joseph Salowey wrote:
>
> First, I apologize for the late review. It appears that you may have
> already had a secdir review from the revision notes, but I could not find
> the review in my archive.
>
>
> The document did already receive a review several months ago, but thank
> you anyway for your comments.
>
>
>  In general it seems the document is in good shape and understandable. I
> think the document is ready with nits.  Here are a few minor issues:
>
>  1) it might be useful to add something about what is in scope and out of
> scope for this document.  What I have in mind is to state the assumption
> that the TZ data has been securely transmitted from the contributors to the
> publishers to the root provider with its integrity intact and that the
> servers are expected to maintain the integrity of the data.
>
>
> I think what you are asking for is clearly stated in the converse already
> in the Introduction as follows:
>
>    This specification defines a time zone data distribution service
>    protocol that allows for fast, reliable and accurate delivery of time
>    zone data and leap second information to client systems.
>
>
> [Joe]  I'm OK with this.


>
>  2) It might be useful to qualify the 3rd paragraph as applicable when
> discovery is done through DNS SRV records.
>
>
> Perhaps you can provide some small amount of text as to what you are
> suggesting, keeping in mind that it's rather late in the day for this
> document.
>
>
[Joe] Sure, how about:

 "A malicious attacker with access to the DNS server data, or able to get
spoofed answers cached in a recursive resolver, can potentially cause
clients to connect to any server chosen by the attacker. When performing
DNS SRV based discovery in the absence of a secure DNS option, clients
SHOULD check that the..."




> Regards,
>
>
>