Subject: [secdir] Secdir review of draft-gont-numeric-ids-sec-considerations-06

From: Charlie Kaufman <[email-masked]>
Date: Sat, 2 Jan 2021 22:25:06 +0000

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

This document (with intended status of BCP) offers (necessarily) vague advice on what specs should say about the selection of transient numeric identifiers used in networking protocols (like TCP sequence numbers, DNS TxIDs, IP Fragment Identifiers, etc.). It updates RFC 3552 ("Guidelines for Writing RFC Text on Security Considerations") in the sense that it offers additional guidance for information to be included in security considerations, though it more importantly offers guidance on how the text prescribing how these transient identifiers are chosen should be specified. The security considerations might include a justification of why those algorithms are appropriate.

Essentially, it says that when picking transient numeric identifiers, beware of leaking information about other things going on at the node choosing the identifiers to either eavesdroppers or to the legitimate target of the communication (or making it possible for someone off-path to guess the identifiers being used and forge packets). There is ample history of implementers making bad choices in this space to warrant getting the advice out there. My only reservation with this document is that it would be nice if the advice could be somewhere more visible (e.g., in some future update to RFC3552).

There are three other I-Ds in process with closely related content; it would be kind to readers if these could be combined into one. They are: draft-gont-predictable-numeric-ids, draft-irtf-pearg-numeric-ids-generation, and draft-irtf-pearg-numeric-ids-history. It's hard to imagine a reader of any one of these who would not benefit from reading the others.

Typos:

p6 Section 4: "to be a predictable" -> "to be predictable"
"identifiers in other context" -> "identifiers in another context"

--Charlie

---

From: Fernando Gont <[email-masked]>
Date: Sat, 2 Jan 2021 23:51:57 -0300

Hello, Charlie,

Thanks a lot for your comments! In-line....

On 2/1/21 19:25, Charlie Kaufman wrote:
[....]
> Essentially, it says that when picking transient numeric identifiers, 
> beware of leaking information about other things going on at the node 
> choosing the identifiers to either eavesdroppers or to the legitimate 
> target of the communication (or making it possible for someone off-path 
> to guess the identifiers being used and forge packets). There is ample 
> history of implementers making bad choices in this space to warrant 
> getting the advice out there. My only reservation with this document is 
> that it would be nice if the advice could be somewhere more visible 
> (e.g., in some future update to RFC3552).
> 
> There are three other I-Ds in process with closely related content; it 
> would be kind to readers if these could be combined into one. They are: 
> draft-gont-predictable-numeric-ids, 
> draft-irtf-pearg-numeric-ids-generation, and 
> draft-irtf-pearg-numeric-ids-history. It's hard to imagine a reader of 
> any one of these who would not benefit from reading the others.

FWIW, this effort originally started as a single document that combined 
the three documents you reference (draft-gont-predictable-numeric-ids). 
However, at the time, when presenting this effort at the SAAG meeting, 
there was agreement that the orginal document 
(draft-gont-predictable-numeric-ids) contained different kinds of 
information (Informational-ish vs. BCP-ish) and thus we were instructed 
to split the original document in three pieces. Since then, each of the 
resulting pieces were progressed on their own, with two of them 
eventually being adopted by the PEARG, and this one 
(draft-gont-numeric-ids-sec-considerations) being progressed as an 
AD-sponsored document.

> "identifiers in other context" -> "identifiers in another context"

Will fix this in the next rev.

Thanks a lot!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492