Subject: [Roll] Stephen Farrell's No Objection on charter-ietf-roll-04-06: (with COMMENT)

From: "Stephen Farrell" <[email-masked]>
Date: Thu, 15 Dec 2016 01:27:40 -0800

Stephen Farrell has entered the following ballot position for
charter-ietf-roll-04-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/charter-ietf-roll/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

I have one non-blocking question for the IESG and WG 
chairs...

The charter continues to say "The Working Group will pay 
particular attention to routing security..."

How do we think that's going? I'm not sure that it's going 
that well - we seem to have a history where ROLL documents
arrive at the IESG lacking security analysis. I don't think
that's because folks are bad or lazy, but it's maybe more 
down to people assuming that security is someone else's
problem (e.g. will be handled by layer 2, or will be part
of some applicability statement, or will be handled by
some RPL security document etc...)

Anyway, now that we're re-chartering, maybe it's a good
time to review how we've been doing on this, given the
history and see if there's anything we could do to avoid
problems arising for future ROLL documents. (I don't have
any specific suggestion for what to do, I just wanted to
see if a discussion of this might be useful.)

---

From: peter van der Stok <[email-masked]>
Date: Thu, 15 Dec 2016 11:02:11 +0100

Hi Stephen,

Indeed, formulating security attacks, analysing their consequences, and 
findig adequate remedies for a routing protocol is a challenging task.
It starts with formulating the attacks, which in my understanding evolve 
over time.

In the 6lo WG a draft has been written to handle privacy issues in a 
coherent way; which proves extremely useful during the IP-over-foo draft 
discussions.
In Roll Michael has written a template for the applicabiity statements, 
including security issues.

In my opinion a draft which helps identifying the threats and their 
(existing) remedies could be a proper way forward.
For Roll such a draft together with Manet, which faces similar wireless 
issues, might be a good starting point.

Any other suggestions, or showing this one to be inadequate, are 
welcome.

peter,