Subject: [secdir] Review of draft-mammoliti-l2tp-accessline-avp-04.txt

From: "Turner, Sean P." <[email-masked]>
Date: Sun, 14 Dec 2008 16:39:51 -0500

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These
comments were written primarily for the benefit of the security area
directors.  Document editors and WG chairs should treat these comments just
like any other last call comments.

This document describes two L2TP AVP extensions to carry subscriber Access
Line identification and characterization information that arrives at the
Broadband Remote Access Server (BRAS) with LAC functionality. It also
defines a mechanism to report connection speed changes, after the initial
connection speeds are sent during session establishment.

The document is well written and I believe it is ready proceed after
addressing the following comment:

The Security Considerations should indicate what would/could happen if the
AVPs are used in a non-secure environment.  The second paragraph in the
security considerations says the AVPs are intended to be used in a secure
environment and the 3rd paragraph says careful consideration should be given
to potential vulnerabilities when implementing in the real world.  I just
think one point of the security considerations for non-security protocols is
to say what bad things can happen if the AVPs/mechanisms are not secured.

Other comments:

Minor: Section 3 2nd para 1st line: Should the "must" be "MUST"?

Nits: 
1. Spell out first use of "LNS" and add definition to Section 2.2.
2. Spell out first use of "LAC" and add definition to Section 2.2.
3. Spell out first use of "LCCE" and add definition to Section 2.2.

_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir

---

From: Carlos Pignataro <[email-masked]>
Date: Sun, 14 Dec 2008 19:43:36 -0500

Sean,

Many thanks for reading the draft and for providing this review
feedback! Please see inline.

> addressing the following comment:

Thanks.

> to say what bad things can happen if the AVPs/mechanisms are not secured.

OK, we'll address this by extending the third paragraph in the Security
Considerations, to describe what could/would happen. This will also
point to the Security Considerations of RFC2661 and RFC3931, since it
seems your comment can be taken more generically as well.

> Minor: Section 3 2nd para 1st line: Should the "must" be "MUST"?

No, we discussed this one among the authors somewhat amply, and
concluded that it was a "must" case.

> 3. Spell out first use of "LCCE" and add definition to Section 2.2.

OK. Will take care of these.

Thanks again,

-- 
--Carlos Pignataro.
Escalation RTP - cisco Systems
_______________________________________________
secdir mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/secdir