Subject: [secdir] Review of draft-ietf-tictoc-security-requirements-11

From: Shawn M Emery <[email-masked]>
Date: Tue, 05 Aug 2014 20:31:22 -0600

Adding secdir, sorry for the duplicate post to this draft's list.

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the IESG.
These comments were written primarily for the benefit of the security
area directors. Document editors and WG chairs should treat these
comments just like any other last call comments.

This informational draft describes the various security issues with time
distribution protocols, specifically the Network Time Protocol (NTP) and
the Precision Time Protocol (PTP).  This is my second review of this draft
and I believe that all of my comments/concerns have been addressed in this
version of the draft.  Thank you.

General comments:

None.

Editorial comments:

None.

Shawn.
--

---

From: Shawn M Emery <[email-masked]>
Date: Fri, 08 Aug 2014 20:24:13 -0600

This informational draft provides guidance on CoAP (Constrained Application Protocol)
communication when using multiple recipients (i.e. multicast).

The security considerations section does exist and does disclose that CoAP group
communication (i.e. multicast transmissions) does lack a security mode and references RFC
7252 for the various attacks.  CoAP relies upon DTLS, which does not currently
have a standardized solution for multicast communication.  The draft goes on to state
the various threats and how to mitigate against said attacks.  It discusses possible
future methods to protect multicast transmissions, such as draft-keoh-dice-multicast-security.
The security considerations does also have a separate section on pervasive monitoring,
which I thought was a good idea, but not just for this draft...

General comments:

None.

Editorial comments:

Please expand the first occurrence of CoAP, unless it's in the common abbreviations list.

Shawn.
--

---

From: "Rahman, Akbar" <[email-masked]>
Date: Fri, 8 Aug 2014 23:33:33 -0400

Thank you for the prompt review, Shawn.

>Please expand the first occurrence of CoAP, unless it's in the common
abbreviations list.

Good catch.  We expand (define) CoAP in the first sentence of the main
body (i.e., section 1.1).  However, we did not expand CoAP in the
Abstract.  We will correct that in our next update.

Best Regards,

Akbar

-----Original Message-----
From: Shawn M Emery [mailto:[email-masked]] 
Sent: Friday, August 08, 2014 10:24 PM
To: [email-masked]
Cc: [email-masked]
Subject: Review of draft-ietf-core-groupcomm-21

This informational draft provides guidance on CoAP (Constrained
Application Protocol) communication when using multiple recipients (i.e.
multicast).

The security considerations section does exist and does disclose that
CoAP group communication (i.e. multicast transmissions) does lack a
security mode and references RFC
7252 for the various attacks.  CoAP relies upon DTLS, which does not
currently have a standardized solution for multicast communication.  The
draft goes on to state the various threats and how to mitigate against
said attacks.  It discusses possible future methods to protect multicast
transmissions, such as draft-keoh-dice-multicast-security.
The security considerations does also have a separate section on
pervasive monitoring, which I thought was a good idea, but not just for
this draft...

General comments:

None.

Editorial comments:

Please expand the first occurrence of CoAP, unless it's in the common
abbreviations list.

Shawn.
--