Subject: [Trans] Threat analysis reviews

From: Melinda Shore <[email-masked]>
Date: Wed, 16 Dec 2015 16:56:12 -0900

Hi, all:

At IETF 94 several people volunteered to review the
threat analysis draft
(https://datatracker.ietf.org/doc/draft-ietf-trans-threat-analysis/).

This is by way of a nudge of those who volunteered (Eran,
Bryan, Rich, Karen).  We really can't move the document
towards working group last call without those reviews.
And, of course, this isn't limited to those who volunteered
at the meeting - anybody who'd like to do a good deed for
the IETF in general and trans in particular is encouraged
to give the draft a careful read and post comments to this
mailing list.

Thanks,

Melinda

---

From: Karen Seo <[email-masked]>
Date: Thu, 17 Dec 2015 15:09:43 -0500

Hi, Melinda,

I have looked at the draft and provided comments that have been 
addressed in the current version.  However, I wasn't at IETF 94 -- It 
must have been a different Karen who volunteered.  Maybe Karen 
O'Donoghue or Karen Nielsen?

Karen

On 12/16/15 8:56 PM, Melinda Shore wrote:
> _______________________________________________
> Trans mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/trans

---

From: Melinda Shore <[email-masked]>
Date: Thu, 17 Dec 2015 11:31:51 -0900

> O'Donoghue or Karen Nielsen?

It was Karen O'Donoghue - sorry for the ambiguity.

Melinda

---

From: Karen Seo <[email-masked]>
Date: Thu, 17 Dec 2015 17:22:06 -0500

No problem.  I was just startled and for a moment concerned that I'd 
forgotten.   Happy Holidays!

---

From: "Salz, Rich" <[email-masked]>
Date: Wed, 23 Dec 2015 18:43:07 +0000

Here's my notes.  All are nits/editorial.  This is a very good document, nice work!

Overall -- should it point out that "revocation" in the sense of CRL's doesn't work in web pki?  I know you say it includes things like blacklists and crlsets (rightfully, without using that browser-specific term)

Overall -- should we say user-agent, not browser?

P3/bottom: Love the definition of the term bogus :)  On next para (p4) need to say "use the term erroneous here"?

P4/bottom: SCT isn't defined before used.

P5/middle: MMD and STH not defined before used?

P6: Fig 1 is a tour de force

P8/middle: remove the <want to list... phrase.
P8/middle: change "to present the forged" to "so that it can present the forged" ?
P8/bottom: Why use single quotes here, but double-quotes in previous words (e.g., bogus)?  Perhaps add a sentence explaining that the malicious term is being used, even when the CA is forced to act under duress?

p10/top: single quotes around fake,  And extra close-paren at end of sec 3.1.1.2
p10/middle: brings up general point that too much important text is put in parenthesis :)

p13/top: Add "For example, the CA could make excuses..."

p14/middle: Remove parens around "(legitimate)"

p14/bottom: Move the "we refer" to p4 as noted above?

P15: Don’t get why those three paragraphs are set off as list items?

p15/bottom: The "Bottom line:" needs to be put into prose :)

p19: These are VERY IMPORTANT QUESTIONS.  Should we have (tentative?) answers?

Rest is fine.  No nits.

---

From: Melinda Shore <[email-masked]>
Date: Wed, 23 Dec 2015 11:32:17 -0900

Many thanks, Rich.  Our goal here is to have the next
version of the draft in sufficiently good shape for
working group last call and broadly supported by the
working group.  We want to avoid surprises during
IESG review or IETF last call, so we really need a
few more reviews before moving it along.

Thanks again,

Melinda

---

From: Stephen Kent <[email-masked]>
Date: Thu, 24 Dec 2015 11:25:07 -0500

Rich,

Thanks for the review and the suggested changes.  I have made edits
to accommodate almost all of your suggested changes.

> Here's my notes.  All are nits/editorial.  This is a very good document, nice work!
thanks.
> Overall -- should it point out that "revocation" in the sense of CRL's doesn't work in web pki?  I know you say it includes things like blacklists and crlsets (rightfully, without using that browse…
I have added a paragraph to address your concern, and modified the text 
slightly:

Certificate Revocations Lists (CRLs) [RFC5280] are the primary means of 
certificate revocation established by IETF (and ISO) standards. 
Unfortunately, most browsers do not make use of CRLs to check the 
revocation status of certificates presented by a TLS Server (Subject). 
Some browsers make use of

Online Certificate Status Protocol(OCSP) data [RFC4366] as a 
standards-based alternative to CRLs. Also, most browser vendors employ 
proprietary

means of revoking certificates, e.g.,via a ''blacklist'' or 
abad-CA-list. Such capabilities enable a browser vendor to cause 
browsers to reject any certificates on the blacklistor for which the 
issuing CA is on the bad-CA-list. This approach also 
remediesmis-issuance. Throughout the remainder of this document 
referencesto certificate revocation as a remedy encompass this and 
analogousforms of browser behavior, if available. Note: there are no IETF

standards defining a browser blacklist of bad-CA list capability.
> Overall -- should we say user-agent, not browser?
I have used the term "browser" because the focus of 6962-bis has been the
browser/WebPKI context, more than the general TLS user agent context.
> P3/bottom: Love the definition of the term bogus :)  On next para (p4) need to say "use the term erroneous here"?
fixed
> P4/bottom: SCT isn't defined before used.
fixed
> P5/middle: MMD and STH not defined before used?
expanded these acronyms.
> P6: Fig 1 is a tour de force
David Mandelberg is responsible for all the ASCII art in this and
out other docs.
> P8/middle: remove the <want to list... phrase.
done
> P8/middle: change "to present the forged" to "so that it can present the forged" ?
fixed
> P8/bottom: Why use single quotes here, but double-quotes in previous words (e.g., bogus)?
my copy shows double quotes here. we'll look into this detail.
>    Perhaps add a sentence explaining that the malicious term is being used, even when the CA is forced to act under duress?
done.
> p10/top: single quotes around fake,
again, my copy shows double quotes.
> And extra close-paren at end of sec 3.1.1.2
removed
> p10/middle: brings up general point that too much important text is put in parenthesis :)
parentheses removed!
> p13/top: Add "For example, the CA could make excuses..."
fixed.
> p14/middle: Remove parens around "(legitimate)"
parenthesis removed.
> p14/bottom: Move the "we refer" to p4 as noted above?
text now notes that the term was introduced in Section 1.
> P15: Don’t get why those three paragraphs are set off as list items?
upon further review, not realy necessary. will make them top-level
paragraphs, no bullets.
> p15/bottom: The "Bottom line:" needs to be put into prose :)
fixed.
> p19: These are VERY IMPORTANT QUESTIONS.  Should we have (tentative?) answers?
I'd like to have answers from the CT designers for these questions. If
we don't have answers, we can say these topics require further
study and thus merit discussion in the Security Considerations sections
of RFCs that purport to define requirements for these elements of CT.

Steve