Alvaro Retana has entered the following ballot position for
draft-ietf-i2rs-protocol-security-requirements-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-i2rs-protocol-security-requirements/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have the same concerns as others around the secure transport, but I'm
not putting in a DISCUSS because the concerns are already well
represented.  Just one additional comment on the topic:

I think there is a contradiction between SEC-REQ-09 ("The I2RS protocol
MUST be able to transfer data over a secure transport and optionally MAY
be able to transfer data over a non-secure transport") and this text from
Section 3. (Security-Related Requirements): "…MUST be able to exchange
data over a secure transport, but some functions may operate on a
non-secure transport."  The latter text talks bout "some functions" using
a non-secure transport, while SEC-REQ-09 implies that everything may use
it.


Other comments from Section 3.1. (Mutual authentication of an I2RS client
and an I2RS Agent) 

-- The text says that the "I2RS architecture [I-D.ietf-i2rs-architecture]
sets the following requirements".  I'm not sure what you mean my "sets",
as there are no requirements (labeled as such) in the architecture
document.  If there are, then this section doesn't seem to be needed (as
others have mentioned).  Maybe "these requirements are derived from the
architecture", or something similar may be more appropriate.

-- What is a "valid identifier"?  A couple of requirements where a "valid
identifier" "MUST" be confirmed are listed, but no indication as to what
that may be in this document or the architecture one.   The definition of
identifier doesn't help…

-- SEC-REQ-05 and SEC-REQ-06 sound the same to me.  What is the
difference?  BTW, if there is a difference, instead of "IETF" I think
that "standardized" may be better.