Subject: [NSIS] Review of "Security Threats for NSIS "

From: [email-masked]
Date: Mon, 7 Jul 2003 15:07:28 +0300

Hi all,

In preparing for IETF 57, I am trying to make a quick review of many of the
documents under discussion.

http://www.ietf.org/internet-drafts/draft-ietf-nsis-threats-02.txt

Overall, I think this document is quite good & quite ready for WG Last Call.
If noone opposes, I would like to start WG last call on this document
starting Wednesday July 9th and run it for 3 weeks until July 23rd.

I am restricting my comments to some more general comments right now.

1) Abstract needs improvement.

Text is:
         
        This threats document provides a detailed analysis of the security 
        threats relevant for the NSIS working group. It motivates and helps 
        to understand various security considerations in the NSIS 
        Requirements, Framework and Protocol proposals. This document does 
        not describe vulnerabilities of specific NSIS protocols. 

Suggested change (feel free to modify accordingly):
         
        This document provides a detailed analysis of the relevant security 
        threats for the NSIS working group. It provides motivatation behind 
	  the various security considerations in the NSIS Requirements and Framework 
	  documents. This document is not meant to describe potential vulnerabilities 
	  of specific NSIS protocols, but provide input into protocol design to
	  ensure security considerations are well thought out prior to design

2) Section 1

There probably is not a need to diagram the different NSIS documents, a bulleted
list might be enough.

3) Terminology shouldn't be a seperate section, perhaps a sub-section.  Are you
sure there is no security-specific terminology that should be added here? IKE,
S/MIME, IPsec, SA probably should be expanded.

4) General comment: blank lines between paragraphs are missing in many places.

5) A summary might be a nice touch at the end.

thanks,
John

_______________________________________________
nsis mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nsis

---

From: Martin Stiemerling <[email-masked]>
Date: Thu, 10 Jul 2003 19:01:27 +0200

Hi,

I have read the -02 draft and it looks fine for me. Here some nits:
- some more terminology would be good, since all the abbrevations, like SA 
or MITM, are not necessary good to guess for people that are not deeply 
involved.
- in section 5.5 RFC3812 is referenced, but actually it is 3182 (as in the 
reference section)
- in 5.10: May the 'adversary' use the the same session id not only for 
security abuse, but as well just by accident?

Martin

--On Monday, July 07, 2003 15:07:28 +0300 [email-masked] wrote:

| Hi all,
|
| In preparing for IETF 57, I am trying to make a quick review of many of
| the documents under discussion.
|
| http://www.ietf.org/internet-drafts/draft-ietf-nsis-threats-02.txt
|
|
| Overall, I think this document is quite good & quite ready for WG Last
| Call. If noone opposes, I would like to start WG last call on this
| document starting Wednesday July 9th and run it for 3 weeks until July
| 23rd.
|
| I am restricting my comments to some more general comments right now.
|
| 1) Abstract needs improvement.
|
| Text is:
|
|         This threats document provides a detailed analysis of the
| security          threats relevant for the NSIS working group. It
| motivates and helps          to understand various security
| considerations in the NSIS          Requirements, Framework and Protocol
| proposals. This document does          not describe vulnerabilities of
| specific NSIS protocols.
|
| Suggested change (feel free to modify accordingly):
|
|         This document provides a detailed analysis of the relevant
| security          threats for the NSIS working group. It provides
| motivatation behind  	  the various security considerations in the NSIS
| Requirements and Framework  	  documents. This document is not meant to
| describe potential vulnerabilities  	  of specific NSIS protocols, but
| provide input into protocol design to 	  ensure security considerations
| are well thought out prior to design
|
| 2) Section 1
|
| There probably is not a need to diagram the different NSIS documents, a
| bulleted list might be enough.
|
| 3) Terminology shouldn't be a seperate section, perhaps a sub-section.
| Are you sure there is no security-specific terminology that should be
| added here? IKE, S/MIME, IPsec, SA probably should be expanded.
|
| 4) General comment: blank lines between paragraphs are missing in many
| places.
|
| 5) A summary might be a nice touch at the end.
|
| thanks,
| John
|
| _______________________________________________
| nsis mailing list
| [email-masked]
| https://www1.ietf.org/mailman/listinfo/nsis

Martin Stiemerling

NEC Europe Ltd. -- Network Laboratories  [email-masked]
IPv4: http://www.ccrle.nec.de  IPv6: http://www.ipv6.ccrle.nec.de