Subject: [secdir] review of draft-arkko-pana-iana-02

From: "Dan Harkins" <[email-masked]>
Date: Thu, 18 Feb 2010 10:53:13 -0800 (PST)

Hello,

  I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

  This draft changes the IANA rules for allocation of protocol fields
to include "IESG approval". It really has no security considerations
and this draft shouldn't warrant much attention from the ADs.

  That said, however, I did find the rationale for relaxing the rules a
bit unconvincing. When RFC 5191 was approved the reasons in the rationale
applied but "IESG approval" was not included. Perhaps it was an oversight
and the WG didn't really want such rigid rules. Or maybe deployment
experience has caused a change of heart. Why now? And why add "IESG
review"? Why not "First Come First Served" or "Expert Review"? What is
it about "IESG review" that makes it appropriate to add now? The
rationale in section 2 could use a bit more explanation. And it seems
strange, to me at least, that a non-WG draft is relaxing rules the WG
set up intentionally for its protocol.

  "IESG approval" is supposed to be rare (according to RFC 5226) so maybe
it would be possible to partition the ranges, leaving the lion's share
the way it was-- "IETF review"-- and giving a reasonable chunk to "IESG
approval" for the rare cases that this route is going to be used? If this
was considered and rejected it might be good to mention that in section 2.

  regards,

  Dan.

---

From: Jari Arkko <[email-masked]>
Date: Wed, 24 Feb 2010 09:26:36 +0200

Dan,

> and this draft shouldn't warrant much attention from the ADs.

OK. Thanks for your review.

> was considered and rejected it might be good to mention that in section 2.

Oversight: As far as I am concerned, not including IESG Approval *is* an 
oversight on all strict IANA allocation rules. If we are not ready to 
say FCFS for various reasons (and there are often good reasons) then at 
least we should provide an ability for someone to decide whether the 
strict rule is absolutely required in all cases. In the IETF the way to 
allow that judgment call to happen is to add "or IESG Approval" to the 
IANA rule.

Why now? Because we have a document (pana-preauth) on IESG review, and 
it cannot be approved since it would need one of the flag bits that is 
Standards Action only per the existing PANA rules. But no one in the 
working or the IESG actually thinks we should block the document.

Non-wg draft: We would have brought this through the working group, but 
I happened to close the working group a while ago, thinking that we were 
done. However, the document has been brought up for review on the PANA 
mailing list.

I hope this helps shed some light on the background, or at least my 
thoughts on it.

Jari