Subject: [Uta] AD Evaluation of draft-ietf-uta-tls-attacks-03

From: Pete Resnick <[email-masked]>
Date: Sun, 28 Sep 2014 08:29:03 -0500

Folks,

I've completed my review of draft-ietf-uta-tls-attacks-03. Fine work; 
it's ready to go to Last Call. Just a few nits, which I'm fine leaving 
until after Last Call:

Section 1: s/motivated/was one of the motivations for/

Section 2: Somewhere explain what the CVE numbers are.

Section 2.8: s/to define/the definition of/

Section 2.13: s/the integration of/when integrating into/

That said, a question, probably mostly for the chairs, but others can of 
course speak up if they have something to add: It seems to me that this 
document could probably wait until the BCP is also ready for Last Call 
because it might be good to review both documents together. Do you 
really want me to Last Call it now (and put a stake in the ground that 
you've gotten it done), or do you want me to hold off for a bit? I'm 
happy to proceed either way.

pr

-- 
Pete Resnick<http://www.qualcomm.com/~presnick/>
Qualcomm Technologies, Inc. - +1 (858)651-4478

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 28 Sep 2014 19:16:23 +0300

Hi Pete,

Thanks for your review!

I am unclear what you mean by: "Somewhere explain what the CVE numbers 
are". We have included a CVE number for those attacks that have such an 
identified vulnerability record. Do you simply want a generic 
explanation of what "CVE" means?

Thanks,
	Yaron

---

From: Pete Resnick <[email-masked]>
Date: Sun, 28 Sep 2014 11:20:28 -0500

On 9/28/14 11:16 AM, Yaron Sheffer wrote:
> are". We have included a CVE number for those attacks that have such 
> an identified vulnerability record. Do you simply want a generic 

Yep. This is a cross area group. Not everyone knows what the IDs are.

pr

---

From: Leif Johansson <[email-masked]>
Date: Sun, 28 Sep 2014 20:52:50 +0200

> Yep. This is a cross area group. Not everyone knows what the IDs are.

You mean "explain what CVE numbers are" rather than "explain those CVE
numbers" right?

---

From: Aaron Zauner <[email-masked]>
Date: Sun, 28 Sep 2014 21:18:09 +0200

> You mean "explain what CVE numbers are" rather than "explain those CVE

Is it really necessary to explain what a CVE assignment is in a
document that explicitly deals with security? If so maybe refrain
from writing another paragraph and just refer to a document like
this one: https://cve.mitre.org/cve/identifiers/

Aaron

---

From: Yaron Sheffer <[email-masked]>
Date: Sun, 28 Sep 2014 22:33:52 +0300

It's easier to add the text than to discuss whether it's needed... See 
http://tools.ietf.org/html/draft-ietf-uta-tls-attacks-04#section-2

By the way, I was surprised that the term "CVE" does not appear in the 
Security Glossary (RFC 4949).

	Yaron

On 09/28/2014 10:18 PM, Aaron Zauner wrote:
> _______________________________________________
> Uta mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/uta
>

---

From: Leif Johansson <[email-masked]>
Date: Mon, 29 Sep 2014 08:56:10 +0200

> http://tools.ietf.org/html/draft-ietf-uta-tls-attacks-04#section-2

This the way to get things "out the door" :-)

---

From: "Orit Levin (LCA)" <[email-masked]>
Date: Mon, 29 Sep 2014 07:25:51 +0000

Pete,
Leif and I talked and we suggest to Last Call it now.
Thanks,
The chairs.

> -----Original Message-----
> From: Uta [mailto:[email-masked]] On Behalf Of Pete Resnick
> Sent: Sunday, September 28, 2014 6:29 AM
> To: [email-masked]
> Subject: [Uta] AD Evaluation of draft-ietf-uta-tls-attacks-03
> 
> Folks,
>

---

From: Pete Resnick <[email-masked]>
Date: Mon, 29 Sep 2014 08:00:30 -0400

>>> You mean "explain what CVE numbers are" rather than "explain those CVE

Yes.

>> document that explicitly deals with security?

As I said, all of the work in this group is likely to be read by 
non-security folks, so I think it's useful.

>> If so maybe refrain

Well done.

> Security Glossary (RFC 4949).

Yes, interesting.

> Leif and I talked and we suggest to Last Call it now.

Wilco.

pr