Subject: [Ecrit] Review comments on security doc

From: Hannes Tschofenig <[email-masked]>
Date: Wed, 03 May 2006 17:23:23 +0200

Hi all,

Kamran provided a review of the ECRIT security threats draft. Thank you 
Kamran!

Ciao
Hannes

------

Hannes below are my the comments as per reviewing the Security Doc _
http://www.ietf-ecrit.org/cache/draft-ietf-ecrit-security-threats-01.txt
. I have indicated the page and section number below to locate my
findings.  Rest of the document is well written and easily understood.

Rgds..
Kamran Aquil
Mitretek Systems.

---------------------

Page 1 - Section Abstract

I would recommend to elaborate the scope of the document in the Abstract
section. It can be best done by bulletizing the two work items, instead
of leaving it meshed among words of the Abstract Paragraph. The two work
items considered in the Security document are

- The Marking of signalling messages to indicate that they are related
to an emergency

- The Process of mapping location to Universal Resource identifiers
(URI) pointing to public safety Answering points (PSAPs)
------------------------------------------------------------------------
--------------------
Page 3 - Section Introduction

Attacks against the PSTN (most often focusing on free calling) have
taken place for decades.
The sentence in the Brackets - "most often focusing on free calling"
needs to be explained further or eliminated. Seems out of context and
may not be clear to the reader.
------------------------------------------------------------------------
----------------------
Page 5 - Section Objective of attacker

Third Bullet item - "No attacks affecting the ECRIT working group's
decisions on the emergency identifier and mapping protocol have been
identified that achieve this objective"

The sentence structure does not convey the message. Please rewrite this
sentence to make it understandable. Need clarity and be more concise.
------------------------------------------------------------------------
---------------------
Page 6 - Section 5.1

Item b is not clear and needs to be rewritten and restructured to make
it clear and concise.

Item c can be rewritten as

C. The call enters the domain of a service provider by applying normal
procedures for authentication and authorization because the signalling
carries the emergency identifiers.
------------------------------------------------------------------------
-------------------------
Page 7 - Section 5.2.1

The heading should be "Attacks against Emergency mapping system"

------------------------------------------------------------------

_______________________________________________
Ecrit mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ecrit