Subject: [secdir] Assignments

From: Samuel Weiler <[email-masked]>
Date: Fri, 18 Dec 2009 18:13:08 -0500 (EST)

Juergen Schoenwaelder is next in the rotation.  Documents on the 
telechat agenda typically have a last call end date before the date 
shown below; reviews by the end of last call are typically more 
appreciated by the doc editors.

Review instructions and related resources are at:
       http://tools.ietf.org/area/sec/trac/wiki/SecDirReview

-- Sam

For telechat 2010-01-07

Reviewer                 Deadline   Draft
Scott Kelly            T 2010-01-05 draft-ietf-fecframe-dvb-al-fec-04
Russ Mundy             T 2010-01-05 draft-ohba-pana-pemk-03
Radia Perlman          T 2010-01-05 draft-ohba-802dot21-basic-schema-07
Eric Rescorla          T 2010-01-05 draft-gennai-smime-cnipa-pec-05
Hannes Tschofenig      T 2010-01-05 draft-ietf-pce-monitoring-07

For telechat 2010-01-21

Reviewer                 Deadline   Draft
Joe Salowey            T 2010-01-19 draft-ietf-pana-preauth-08
Stefan Santesson       T 2010-01-19 draft-ietf-trill-rbridge-protocol-14
Larry Zhu              TR2010-01-19 draft-moriarty-post-inch-rid-09

Last calls and special requests:

Reviewer                 Deadline   Draft
Rob Austein              2009-11-28 draft-ietf-pkix-attr-cert-mime-type-02
Dave Cridland            2009-11-25 draft-ietf-nsis-qspec-22
Alan DeKok               2009-10-01 draft-ietf-enum-enumservices-transition-04
Alan DeKok               2009-12-07 draft-ietf-capwap-802dot11-mib-05
Love Hornquist-Astrand   2009-06-29 draft-ietf-opsawg-smi-datatypes-in-xsd-05
Love Hornquist-Astrand   2009-10-13 draft-ietf-idnabis-mappings-05
Jeffrey Hutzelman        2009-10-15 draft-ietf-idnabis-protocol-17
Jeffrey Hutzelman        2009-12-07 draft-ietf-capwap-base-mib-06
Charlie Kaufman          2009-12-14 draft-ietf-dkim-deployment-10
Stephen Kent             2009-12-10 draft-ietf-tsvwg-rsvp-security-groupkeying-05
Chris Lonvick            2010-01-01 draft-giralt-schac-ns-02
Catherine Meadows        2008-01-17 draft-ietf-speechsc-mrcpv2-20
Catherine Meadows        2009-12-22 draft-ietf-sipping-config-framework-16
Russ Mundy               2009-10-21 draft-ietf-hokey-preauth-ps-11
Sandy Murphy            R2009-11-18 draft-ietf-mpls-mpls-and-gmpls-security-framework-07
Sandy Murphy             2010-01-14 draft-turner-ecprivatekey-02
Vidya Narayanan          2008-11-21 draft-ietf-sip-saml-06
Chris Newman             2010-01-07 draft-ietf-krb-wg-preauth-framework-15
Magnus Nystrom           2009-12-24 draft-josefsson-kerberos5-starttls-07
Hilarie Orman            2010-01-14 draft-kato-tls-rfc4132bis-04
Radia Perlman            2009-12-10 draft-bryan-http-digest-algorithm-values-update-03
Eric Rescorla            2010-01-11 draft-brown-versioning-link-relations-05
Joe Salowey              2009-02-08 draft-ietf-geopriv-lis-discovery-13
Juergen Schoenwaelder   R2010-01-13 draft-ietf-behave-turn-uri-05
Sam Weiler               2008-08-13 draft-chown-v6ops-rogue-ra-03
Brian Weis               2009-10-20 draft-ietf-l3vpn-e2e-rsvp-te-reqts-04
Nico Williams            2008-08-13 draft-ietf-v6ops-ra-guard-04
Larry Zhu                2008-08-13 draft-thaler-v6ops-teredo-extensions-05
Larry Zhu                2009-05-09 draft-ietf-ecrit-location-hiding-req-02

---

From: Stephen Kent <[email-masked]>
Date: Fri, 18 Dec 2009 21:23:14 -0500

This is the message I sent to the WG chairs  o 11/30, in response to 
this special request.

Steve
------

Folks,

As per your request I reviewed the subject document.

It has a LOT of problems:

	- the authors are inconsistent in their use of terms in 
various places in the document (e.g., trust zone, trust domain, trust 
group)

	- the authors do not clearly define what they mean by static, 
manual, or  dynamic keying. they then make general assertions about 
the costs of various keying methods without providing any analysis to 
support their assertions.

	- the authors are clearly big proponents of group keying, and 
so they sweep under the rug all the details of what one has to do to 
authenticate group members to a group key server and what the server 
needs to do to distribute keys to the group members. there may be 
good arguments for why group keying is preferable to alternatives, 
but this document does not make that case

	- the authors assert that tunnel mode ESP is unsuitable for 
use with RSVP due to a MITM vulnerability, but the argument they 
present is flawed.

	- the authors assert that using the group keying mechanisms 
in RFC 3547 solves the problems of using IPsec with RSVP, which 
contradicts statements elsewhere about problems with IPsec protocols 
and RSVP.

	- the authors argue that Section 3.1 of RFC 5374 describes 
how to use tunnel mode in a way that fixes problems otherwise present 
with AH or ESP, but the argument is suspect. The cited section talks 
about a new version of tunnel mode for use by secruity gateways when 
sending traffic on multicast SAs, but there is not reason why routers 
using RSVP should be viewed as secruity gateways with respect to RSVP 
traffic.

	- overall, the document is very poorly organized. it rambles 
and makes arguments in one section that appear to contradict analyses 
in other sections.

I have attached an edited version of the document with suggested 
edits and lots of comments.

Steve