Subject: [Gen-art] Gen-ART review of 2 rohc-sigcomp drafts

From: [email-masked]
Date: Thu, 15 Dec 2005 14:49:20 -0500

draft-ietf-rohc-sigcomp-torture-tests-03.txt
draft-ietf-rohc-sigcomp-user-guide-04.txt 

Background for those who may be unaware of GenART:

GenART is the Area Review Team for the General Area of the IETF.
We advise the General Area Director (i.e. the IETF/IESG chair) by
providing more in depth reviews than he could do himself of documents
that come up for final decision in IESG telechat.  I was selected
as the GenART member to review this document.  Below is my review,
which was written specifically with an eye to the GenART process, but
since I believe that it will be useful to have these comments more
widely distributed, others outside the GenART group are included.

Review criteria for WG submissions: "Is this document a reasonable
contribution to the area of Internet engineering which it covers? If
not, what changes would make it so?"

These drafts are basically ready for publication, but have nits that
should be fixed before publication.

The drafts are well-written, and clear, plus I'm late in getting
to this review, so I'll limit myself to one nit:

The Security Considerations section of the torture tests draft
understates the security value of the draft.  The torture tests
include tests for a significant number of "boundary and error cases"
for execution of UDVM bytecode.  A common attack vector against
a virtual machine like UDVM is to find a boundary or error case
where the bytecode can escape containment by the virtual machine,
enabling the bytecode to mount an attack on the internals of the
virtual machine implementation.  Ensuring that a UDVM implementation
executes this set of torture tests correctly should close off a
significant number of possible opportunities for containment escape,
contributing to the security of implementations.

It would be good to add a few sentences about this to the Security
Considerations section, but it is not necessary to do so.

The user guide draft looks fine on a quick read.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------

_______________________________________________
Gen-art mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/gen-art