Last Call Review of draft-ietf-jmap-mail-14
review-ietf-jmap-mail-14-secdir-lc-nystrom-2019-02-21-00
Request | Review of | draft-ietf-jmap-mail |
---|---|---|
Requested revision | No specific revision (document currently at 16) | |
Type | Last Call Review | |
Team | Security Area Directorate (secdir) | |
Deadline | 2019-02-04 | |
Requested | 2019-01-21 | |
Authors | Neil Jenkins , Chris Newman | |
I-D last updated | 2019-02-21 | |
Completed reviews |
Secdir Last Call review of -14
by Magnus Nyström
(diff)
Genart Last Call review of -14 by Dan Romascanu (diff) |
|
Assignment | Reviewer | Magnus Nyström |
State | Completed | |
Request | Last Call review on draft-ietf-jmap-mail by Security Area Directorate Assigned | |
Reviewed revision | 14 (document currently at 16) | |
Result | Has issues | |
Completed | 2019-02-21 |
review-ietf-jmap-mail-14-secdir-lc-nystrom-2019-02-21-00
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines a data model for mail over JMAP. JMAP is a JSON-based protocol for synchronization of data between clients and servers. - Section 9, the Security Considerations section, generally refers to draft-ietf-jmap-core for security considerations. I would agree with this. I wonder for a new protocol like this though, if TLS 1.3 should be required? - Also, for draft-ietf-jmap-core, it would be nice if Basic Auth could be disallowed for a new protocol like this - trying to move away from passwords - The rest of the Security Considerations section seems fine to me. - Editorial; Section 9.3: "Milter protocol" - I understand this is short-hand for "mail filter protocol," but perhaps this should be written out, maybe with some reference? I also could not find the term defined in draft-ietf-jmap-core. - Also in 9.3, should "the Milter protocol" be "a Milter protocol"? Not sure. Thanks. -- Magnus