Subject: [apps-discuss] APPS Area review of draft-ietf-geopriv-policy-uri-04

From: Tobias Gondrom <[email-masked]>
Date: Sat, 10 Dec 2011 05:17:55 +0000

I have been selected as the Applications Area Directorate reviewer for 
this draft (for background on appsdir, please see  
http://trac.tools.ietf.org/area/app/trac/wiki/ApplicationsAreaDirectorate).

Please resolve these comments along with any other Last Call comments 
you may receive. Please wait for direction from your document shepherd 
or AD before posting a new version of the draft.

Document: draft-ietf-geopriv-policy-uri-04
Title: Location Configuration Extensions for Policy Management
Reviewer: Tobias Gondrom
Review Date: 10.12.11

Summary:
"This draft is almost ready for publication as an RFC but has a few 
issues around access control and data leakage (allowed use of http) that 
should be fixed before publication."

Major Issues:

1. Section 3.1
"Knowledge of the policy URI can be considered adequate evidence of 
authorization"
As far as I understand that would imply that there is no further access 
control for GET/PUT/DELETE intended?
I am not sure I would agree with that. Using that paradigm possible 
attackers could indeed try to ping for a variety of URI addresses and 
will either receive a "does not exist" or the policy resource (in which 
case they would automatically be granted with the right to delete or 
update the policy)?
Furthermore if more than one device/service shares the same policy URI, 
they will have both full read/write access to the policy?
Therefore I would strongly suggest to add notes that update and delete 
request MUST/SHOULD be authorised/authenticated by other means beyond 
pure knowledge or URI.

2. The creation criteria in section 3.2 are nice but appear to be 
insufficient/too weak:
"A policy URI is effectively a shared secret between Location Server
    and its clients.  Knowledge of a policy URI is all that is required
    to perform any operations allowed on the policy.  Thus, a policy URI
    should be constructed so that it is hard to predict and
    confidentiality-protected when transmitted (see Section 7).  To avoid
    re-using these shared secrets, the Location Server MUST generate a
    new policy URI whenever it generates a new location URI set."

Please consider that a server defending against brute force scanning 
with the current model will only reply with 404 (not found) to 
non-existant resources (which in general is no indication for a server 
that an attack is under way, e.g. there could equally be a search engine 
or site mapping scanner be at work). While when using a form of 
authentication the server can distinguish failed access attempts as it 
will result in 401/403 errors access denied / forbidden - errors that 
can more easily used to identify failed attempts to gain access to 
policy URIs.

3. Also consider that with "A policy URI is effectively a shared secret 
between Location Server and its clients." and the above section on 
access rights all involved parties have equal access rights for 
GET/PUT/DELETE, although they may not always be intended to be symmetric?

4. Section 4.1.
" A policy URI MUST
    use the "http:" or "https:" scheme, and the Location Server MUST
    support the specified operations on the URI."
Considering the confidential nature of the URI and the shared secret 
aspects, you should amend this by at least strongly suggesting that the 
"https scheme SHOULD be used whenever possible".

the same in section 4.2.

Minor Issues:
some of the abstract and introduction are particularly hard to read 
(even for RFCs). It might be useful to let a native speaker read over 
them and make them smoother / easier to understand.

Best regards, Tobias