Subject: [apps-discuss] apps-review team review of draft-ietf-csi-hash-threat-10

From: Barry Leiba <[email-masked]>
Date: Sat, 16 Oct 2010 09:09:24 -0400

I have been selected as the Applications Area Review Team reviewer for
this draft (for background on apps-review, please see
http://www.apps.ietf.org/content/applications-area-review-team).
Please resolve these comments along with any other Last Call comments
you may receive. Please wait for direction from your document shepherd
or AD before posting a new version of the draft.

Document: draft-ietf-csi-hash-threat-10
Title: SEND Hash Threat Analysis
Reviewer: Barry Leiba
Review Date: 15 Oct 2010
Summary: This draft is ready for publication as an Informational RFC

Major Issues: none

Minor Issues:
In section 3.3, you say "Since the structure of the Neighbor Discovery
messages is well defined, it is not possible to use this vulnerability
in real world attacks."  That's a strong statement, and it might be
*possible* to find a usable hash collision, however unlikely that may
be.  I'd say "not practical", instead.  But this is such a small point
that it hardly matters.

Nits: There are a few punctuation errors and the like, but the RFC
editor will take care of them.

Barry
--
Barry Leiba  ([email-masked])
http://internetmessagingtechnology.org/

---

From: Suresh Krishnan <[email-masked]>
Date: Mon, 18 Oct 2010 10:19:48 -0400

Hi Barry,
   Thanks for the review.

> be.  I'd say "not practical", instead.  But this is such a small point

Good catch. We will make this change.

Thanks
Suresh