Re: [secdir] Secdir review of draft-ietf-ippm-owamp-registry-03

"MORTON, ALFRED C (AL)" <acmorton@att.com> Thu, 17 September 2015 14:02 UTC

From: "MORTON, ALFRED C (AL)" <acmorton@att.com>
To: Alan DeKok <aland@deployingradius.com>, "secdir@ietf.org" <secdir@ietf.org>
Date: Thu, 17 Sep 2015 10:02:49 -0400
Thread-Topic: Secdir review of draft-ietf-ippm-owamp-registry-03
Thread-Index: AdDwr+ejrlXABYCpRsygInVxFp7LpAAn3HQw
Message-ID: <4AF73AA205019A4C8A1DDD32C034631D0BB4581583@NJFPSRVEXG0.research.att.com>
References: <6FD706E2-FEAC-4EF2-BCE8-43D16095BB11@deployingradius.com>
In-Reply-To: <6FD706E2-FEAC-4EF2-BCE8-43D16095BB11@deployingradius.com>
Accept-Language: en-US
Content-Language: en-US
acceptlanguage: en-US
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Archived-At: <http://mailarchive.ietf.org/arch/msg/secdir/mwPI-gf5O1WVZ63OV9spfu9Wnx0>
Cc: "ippm-ads@ietf.org" <ippm-ads@ietf.org>, "ippm-chairs@ietf.org" <ippm-chairs@ietf.org>, "draft-ietf-ippm-owamp-registry@tools.ietf.org" <draft-ietf-ippm-owamp-registry@tools.ietf.org>, "ippm@ietf.org" <ippm@ietf.org>
Subject: Re: [secdir] Secdir review of draft-ietf-ippm-owamp-registry-03
Precedence: list

Hi Alan,
thanks for your review, please see replies below.
FWIW - I had to look-up the details.
Al

> -----Original Message-----
> From: Alan DeKok [mailto:aland@deployingradius.com]
> Sent: Wednesday, September 16, 2015 2:03 PM
> To: secdir@ietf.org
> Cc: draft-ietf-ippm-owamp-registry@tools.ietf.org
> Subject: Secdir review of draft-ietf-ippm-owamp-registry-03
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
>   This document requests IANA allocation of registries for OWAMP.   As
> such, it has minimal security impact.
> 
>   One practical note is the request to assign an "Experimentation"
> OWAMP-Control Command Number.  Experience shows that such numbers are
> either never used, or used as experiments... which then get widely
> deployed before standards action catches up to practical needs.

[ACM] 
I understand how this might happen, but IETF already has a 
BCP that covers this topic: https://tools.ietf.org/html/bcp82

> 
>   It may be good to add some discussion as to *how* experiments are
> done, and how experiments can transition from the "Experimentation"
> number to a standard number.

[ACM] 
IMO, BCP82 covers this aspect adequately. 

> 
>   One suggestion would be to change the label from "Experimentation" to
> "Site-Local".  That would still allow sites to experiment with OWAMP-
> Control commands, but would make it clearer that such experimentation is
> only for the local site, and MUST NOT be used in a  wider context.

[ACM] 
Site-local is not a valid registry assignment, see:
https://tools.ietf.org/html/rfc5226#section-4
Also, I would expect that an Internet performance characterization
protocol will be deployed on the Internet when using an experimental command
to conduct experiments, so not Site-Local.

Note that the existing reference to RFC5226 makes a clear reference to
BCP 82 in section 4.

[secdir] Secdir review of draft-ietf-ippm-owamp-r… Alan DeKok
Re: [secdir] Secdir review of draft-ietf-ippm-owa… MORTON, ALFRED C (AL)