Last Call Review of draft-ietf-idnabis-bidi-
|Requested rev.||no specific revision (document currently at 07)|
|Type||Last Call Review|
|Team||Security Area Directorate (secdir)|
|Draft last updated||2009-10-16|
Secdir Last Call review of -?? by Sam Hartman
Secdir Telechat review of -?? by Sam Hartman
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Feel free to forward to any appropriate forum. This document describes a new rule for handling bidirectional attributes of Unicode characters and the bidirectional text wrapping algorithm. I am not qualified to evaluate the security implications of this draft: I do not understand all the implications, and recommend that the security ADs take a close look. The draft is well written. Even given my limited information on the subject, I found the draft relatively clear--or, at least, clear enough that I understood some of my gaps. There is one major deficiency in the security considerations section. The major attack against naming systems is incorrect mappings; in the case of DNS mappings used by humans this broadly falls into the category of phishing or other cases where humans are confused into thinking they have accessed a desired resource but in fact have accessed some other resource.. Section 3 discusses several requirements that could not be met and several confusing situations. However the security considerations section does not discuss the security implications of this, or even discuss phishing/confusing names at all. I'll give the editors some slack here: I have no idea what to write either. However it seems like we should write something. I think advice from the security ADs on what level of detail would be desired in the security considerations section of this document would be in order. I found section 3 particularly useful. I think it is important than someone who understands this better than I look at the attacks that are enabled by the requirements that were considered and rejected to understand how serious they are. All in all, this is a great document.