Subject: [secdir] Security review of draft-ietf-pce-questions-06

From: Ben Laurie <[email-masked]>
Date: Tue, 1 Jul 2014 15:45:34 +0100

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Status: ready with issues.

The security considerations section makes this claim:

"This informational document does not define any new protocol elements
or mechanism.  As such, it does not introduce any new security
issues."

I agree with the premise, but not the conclusion: just because an RFC
does not introduce new security issues, that does not mean that there
are no security considerations.

Indeed, this RFC discusses many things that have quite serious
security considerations, without mentioning any of them. For example,
section 4 "How Do I Find My PCE?" (the very first question) advocates
a number of potentially completely insecure mechanisms with no mention
of their security properties (or otherwise). This is obviously
pervasive, given the stance taken in the security considerations.

The document does mention that RFC 6952 gives a security analysis for
PCEP, and perhaps this is sufficient but it seems to me that a
document intended to give useful background information to noobs
should include security directly in that information rather than defer
to another giant document (which mixes PCEP info with other
protocols).

---

From: "Adrian Farrel" <[email-masked]>
Date: Thu, 3 Jul 2014 22:43:34 +0100

Hi Ben,

Thanks for reading and letting us know your thoughts.

> these comments just like any other last call comments.

Could I please ask you to re-send your mail to the IETF list "just like any other last call comments" so that we can respond to them there as part of the consensus process. That is, of course, unless you feel that your comments fall into the escape clause in the last call announcement : "Exceptionally, comments may be sent to [email-masked] instead."

Cheers,
Adrian

---

From: Ben Laurie <[email-masked]>
Date: Fri, 4 Jul 2014 13:08:28 +0100

> Could I please ask you to re-send your mail to the IETF list "just like any other last call comments" so that we can respond to them there as part of the consensus process. That is, of course, unle…

I am following the Security Directorate process here:
http://tools.ietf.org/area/sec/trac/wiki/SecDirReview.

But sure, I'll send a copy to the IETF list.

---

From: Stephen Farrell <[email-masked]>
Date: Fri, 04 Jul 2014 15:30:13 +0100

Hi Adrian, all,

Thanks for those reviews, they really help so keep 'em
coming!

Adrian asked Ben to re-tx his review to the IETF list,
and Ben replied:

> But sure, I'll send a copy to the IETF list.

We debate this from time to time and so far always land
where we started, which is the above guidance:-)

A substantial number of reviews are nits only and folks
don't feel that sending to the main IETF list is worth
it for those. And sometimes some reviewers are probably
worried that sending to the main IETF list might lead to
a thread that consumes more time than the reviewer has
available.

Anyway, for anyone who's new to this and not sure, or
has forgotten, the above URL is worth a look, and just
use your judgement as to whether or not you send your
review to the main IETF list. Equally, its just fine
if someone asks that the review be re-tx'd as Adrian
did, so I hope folks just do that in those cases, as
Ben did:-)

Cheers,
S.

---

From: "Adrian Farrel" <[email-masked]>
Date: Fri, 4 Jul 2014 16:12:18 +0100

Thanks Ben,

Much appreciated. I think your comments as Last Call comments deserve public discussion as they might need substantial changes to the document, so the issue is one of establishing consensus.

A

> -----Original Message-----
> From: Ben Laurie [mailto:[email-masked]]
> Sent: 04 July 2014 13:08
> To: [email-masked]
> Cc: The IESG; [email-masked]; [email-masked]
> Subject: Re: Security review of draft-ietf-pce-questions-06
> 
> > Could I please ask you to re-send your mail to the IETF list "just like any other
> last call comments" so that we can respond to them there as part of the
> consensus process. That is, of course, unless you feel that your comments fall
> into the escape clause in the last call announcement : "Exceptionally, comments
> may be sent to [email-masked] instead."
>