Subject: [stir] AD review of draft-ietf-stir-threats

From: Richard Barnes <[email-masked]>
Date: Fri, 20 Jun 2014 16:33:41 -0400

I have reviewed this draft in preparation for IETF LC.  Overall, it looks
to be in good shape, but could use a few revisions for clarity, noted
below.  I've requested last call.

Thanks,
--Richard

EDITORIAL

S1. "post-setup changes to the call are outside the scope"
Would it be correct to note that part of the reason this is OK is that you
had a chance to verify the identity the first time?  Sort of like with
HTTPS when you get a redirect to another site.

S3. "those where ..., and those where..."
These are in the opposite order of the sections below.

S3.1. "on the basis of the calling party number"
It could be helpful to note here that the caller is being excused from
normal authentication checks (like a PIN), e.g.:
NEW: "A voicemail service may allow users calling from their phones access
to their voicemail boxes on the basis of the calling party number, as
opposed to requiring some other authentication, like a PIN.

S3.1. "absence of a calling identity"
What you're talking about here is not the absence of a calling identity;
the attacker can still provide an identity.  Better: "absence of a
verifiably legitimate calling identity"

S3.1. "If the voicemail service could learn ahead of time..."
It might be worth noting here that voicemail services in particular (as
opposed to banks, airlines, etc.) are often operated by the same
organization that would be in a position to enable or require
authentication of calling party identity for calls that would end up at the
voicemail server.

S4.1. "Solution-specific attacks are outside the scope of this document"
It was not clear to me on first reading what was meant by
"solution-specific attacks".  Suggest a sentence at the beginning, e.g.:
"Solutions that address this threat model will inevitably be vulnerable to
additional attacks, beyond those discussed above, which are specific to the
solution."

S4.1.
"Attacks Against In-Band" -> "Attacks Against In-Band Solutions"
"Attacks Against Out-of-Band" -> "Attacks Against Out-of-Band Solutions"
And a reference to draft-ietf-stir-problem-statement for these terms might
not hurt.

S4.1. "CPRs" is not defined

S4.1. Please expand "data mining".  "... by the CPS" ?  (and if so,
define/expand CPS)

---

From: "Peterson, Jon" <[email-masked]>
Date: Fri, 20 Jun 2014 20:54:48 +0000

These changes all look fine; I'll get these fixed up along with any other LC comments.

Jon Peterson
Neustar, Inc.

Sent from my iPad

> On Jun 20, 2014, at 1:33 PM, "Richard Barnes" <[email-masked]> wrote:
> 
> I have reviewed this draft in preparation for IETF LC.  Overall, it looks to be in good shape, but could use a few revisions for clarity, noted below.  I've requested last call.
> 
> Thanks,
> --Richard
> 
> 
> EDITORIAL
> 
> Would it be correct to note that part of the reason this is OK is that you had a chance to verify the identity the first time?  Sort of like with HTTPS when you get a redirect to another site.
> 
> It could be helpful to note here that the caller is being excused from normal authentication checks (like a PIN), e.g.:
> NEW: "A voicemail service may allow users calling from their phones access to their voicemail boxes on the basis of the calling party number, as opposed to requiring some other authentication, like a PIN.
> 
> What you're talking about here is not the absence of a calling identity; the attacker can still provide an identity.  Better: "absence of a verifiably legitimate calling identity"
> 
> It might be worth noting here that voicemail services in particular (as opposed to banks, airlines, etc.) are often operated by the same organization that would be in a position to enable or require authentication of calling party identity for calls that would end up at the voicemail server.
> 
> It was not clear to me on first reading what was meant by "solution-specific attacks".  Suggest a sentence at the beginning, e.g.:
> "Solutions that address this threat model will inevitably be vulnerable to additional attacks, beyond those discussed above, which are specific to the solution."
> 
> S4.1. 
> And a reference to draft-ietf-stir-problem-statement for these terms might not hurt.
> 
> S4.1. Please expand "data mining".  "... by the CPS" ?  (and if so, define/expand CPS)
> 
> 
> _______________________________________________
> stir mailing list
> [email-masked]
> https://urldefense.proofpoint.com/v1/url?u=https://www.ietf.org/mailman/listinfo/stir&k=lQ50IrZ4n2wmPbDBDzKBYw%3D%3D%0A&r=8DMZR2OPVO0EflFSzDaVn8Q%2B31F1WQyjSQmLQXwHuHE%3D%0A&m=5%2FaJy6aNXt9cT%2Fv%2Fvsde46xIM0QYgWkaVHGMlJCmEHM%3D%0A&s=574438fe2af74cdc049b8941fccd6b8cbb72886640a3192416323ec6a3be84d3