[secdir] review of draft-ietf-mpls-smp-requirements-06

Chris Inacio <inacio@cert.org> Mon, 23 June 2014 13:59 UTC

From: Chris Inacio <inacio@cert.org>
To: "<secdir@ietf.org>" <secdir@ietf.org>
Thread-Topic: review of draft-ietf-mpls-smp-requirements-06
Thread-Index: AQHPjutOvsydJA6Q1kiOlx9WmLKIAw==
Date: Mon, 23 Jun 2014 13:59:09 +0000
Message-ID: <4B67B93E-4E34-4A62-9B07-B0E3F1DCEDDA@cert.org>
Accept-Language: en-US
Content-Language: en-US
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <DEE3D0D35CC58047BB297EA2DD18526F@sei.cmu.edu>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: http://mailarchive.ietf.org/arch/msg/secdir/oW41CaYW1rv5HXPmYseIey3wYsg
Cc: "draft-ietf-mpls-smp-requirements-06.all@tools.ietf.org" <draft-ietf-mpls-smp-requirements-06.all@tools.ietf.org>, "<iesg@ietf.org> IESG" <iesg@ietf.org>
Subject: [secdir] review of draft-ietf-mpls-smp-requirements-06
Precedence: list

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG. These comments were written primarily for the benefit of the
security area directors. Document editors and WG chairs should treat
these comments just like any other last call comments.

Firstly, this document is a requirements document, and therefore doesn’t necessarily have a large need for security considerations, the resulting protocols can bear the burden. Although I wouldn’t complain if the authors had put more into the security considerations in the requirements – like acknowledging the exhaustion of resources related to preemption, especially by a malicious actor. Or a malicious actor attempting to cause a alternate path to force traffic by a sensor/device.

The security considerations section references the security considerations to 2 other RFCs, which in turn references multiple other RFCs which reference multiple standards. My depth limit of reviewing the security considerations sections stopped at 1-level of reference. It is assumed that the related RFCs have also gone through security review previous and that review is sufficient in this case.

Editorial NITS:

Section 4.1, last paragraph:

the commitment of the shared
resources are be coordinated between the different working paths in
the SMP network.

should be:

shared resources are to be coordinated

Section 5.5:

Referring the “former" and “later”, each with a complex combination of events and times is a bit difficult to read, even though the sentences are completely correctly structured. It might be worth being a little more verbose to simplify the reading. I say this as a native english speaker. I wouldn’t want to read that if English was my second language.

regards,
--
Chris Inacio
inacio@cert.org

[secdir] review of draft-ietf-mpls-smp-requiremen… Chris Inacio