Subject: [secdir] secdir review of draft-ietf-mpls-ipv6-only-gap-02

From: Tobias Gondrom <[email-masked]>
Date: Wed, 22 Oct 2014 23:15:55 +0100

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

The draft is informational and identifies and analyses gaps that must be 
addressed in order to allow MPLS-related protocols and applications to 
be used with IPv6-only networks.

The document appears ready for publication.

The security considerations section (section 8) only states that 
changing the address family used for MPLS network operation does not 
fundamentally alter the security considerations of the existing 
protocol. Which is basically correct. It could have been interesting to 
look at the gaps analysis from a security perspective and see which of 
the MPLS IPv6-only gaps has security implications that need to be 
addressed. I.e. which gaps are security related. However, that is not 
essential.

Comment:
1. Abstract and Section 1:
the sentence "This document is not intended to highlight a particular 
vendor's implementation (or lack thereof)" sounds odd. Is there a WG 
discussion background or why is this document speaking of one 
"particular vendor's implementation"?

Nits:
- section 3.3.1.1. EVPN
formating: do you want to add one line at the end of the section: "Gap: 
Minor...."

I did not find anything else in my review.

Thank you and best regards.

Tobias

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Tue, 28 Oct 2014 17:49:07 +0000

Tobias,

Many thanks for your review, and apologies for a delayed response. Please see inline.

> On Oct 22, 2014, at 6:15 PM, Tobias Gondrom <[email-masked]> wrote:
> 
> 
> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
> 
> 
> The draft is informational and identifies and analyses gaps that must be addressed in order to allow MPLS-related protocols and applications to be used with IPv6-only networks.
> 

Thanks!

> 
> The security considerations section (section 8) only states that changing the address family used for MPLS network operation does not fundamentally alter the security considerations of the existing protocol. Which is basically correct. It could have been interesting to look at the gaps analysis from a security perspective and see which of the MPLS IPv6-only gaps has security implications that need to be addressed. I.e. which gaps are security related. However, that is not essential.
> 

Ack.

> the sentence "This document is not intended to highlight a particular vendor's implementation (or lack thereof)" sounds odd. Is there a WG discussion background or why is this document speaking of one "particular vendor's implementation”?

We just wanted to proactively clarify that this gap analysis is one on specifications and not in implementations. The important part of that sentence is what follows: “, but rather to focus on gaps in the standards defining the MPLS suite."

> Nits:
> - section 3.3.1.1. EVPN
> formating: do you want to add one line at the end of the section: "Gap: Minor….
> “
> 

Good catch — fixed.

> I did not find anything else in my review.

Thanks!

Carlos.

---

From: Tobias Gondrom <[email-masked]>
Date: Wed, 29 Oct 2014 11:46:20 +0800

Carlos,

thanks for your reply.
One note inline.

> We just wanted to proactively clarify that this gap analysis is one on specifications and not in implementations. The important part of that sentence is what follows: “, but rather to focus on gaps…

I fully understand and saw the following sentence.
Just to explain further why I felt the sentence is odd:
Actually the wording "a particular" might give a strange impression. It 
might just be me being paranoid or overly curious, but if I read a 
document explicitly denies something, it makes me curious as to why it 
does so and whether there was an according aspect behind it. Otherwise, 
why would a document explicitly deny something. ;-)
E.g. if the document speaks about "not intended to highlight a 
particular vendor's implementation" it gives the feeling as if it might 
have started as looking at one particular vendor.

If you like to clarify the message as you described in your answer, you 
might want to rephrase by removing the "a" before "particular" or phrase 
it in a positive way as like ".... is about specifications and not about 
particular vendor implementations..."

Just a thought.

Best, Tobias

>> formating: do you want to add one line at the end of the section: "Gap: Minor….
Thanks.

---

From: "Carlos Pignataro (cpignata)" <[email-masked]>
Date: Wed, 29 Oct 2014 14:45:18 +0000

Tobias,

On Oct 28, 2014, at 11:46 PM, Tobias Gondrom <[email-masked]<mailto:[email-masked]>> wrote:

Carlos,

thanks for your reply.
One note inline.

On Oct 22, 2014, at 6:15 PM, Tobias Gondrom <[email-masked]<mailto:[email-masked]>> wrote:

Ack.

Comment:

I fully understand and saw the following sentence.
Just to explain further why I felt the sentence is odd:
Actually the wording "a particular" might give a strange impression. It might just be me being paranoid or overly curious, but if I read a document explicitly denies something, it makes me curious as to why it does so and whether there was an according aspect behind it. Otherwise, why would a document explicitly deny something. ;-)
E.g. if the document speaks about "not intended to highlight a particular vendor's implementation" it gives the feeling as if it might have started as looking at one particular vendor.

If you like to clarify the message as you described in your answer, you might want to rephrase by removing the "a" before "particular" or phrase it in a positive way as like ".... is about specifications and not about particular vendor implementations..."

Just a thought.

I agree with you, it’s a good thought. We can turn around in a positive way, and remove the “a”, like this:

      This document is intended to  focus on gaps in
      the standards defining the MPLS suite, and not to
      highlight particular vendor implementations (or lack thereof) in the
      context of IPv6-only MPLS functionality.

Thanks,

Carlos.

Best, Tobias

Nits:
- section 3.3.1.1. EVPN

Good catch — fixed.
Thanks.

Thanks!

Carlos.

Tobias

---

From: Tobias Gondrom <[email-masked]>
Date: Fri, 31 Oct 2014 20:10:13 +0800

Thanks.
Tobias

On 29/10/14 22:45, Carlos Pignataro (cpignata) wrote:
> Tobias,
>
>> On Oct 28, 2014, at 11:46 PM, Tobias Gondrom 
>> <[email-masked] <mailto:[email-masked]>> wrote:
>>
>> Carlos,
>>
>> thanks for your reply.
>> One note inline.
>>
>>>> On Oct 22, 2014, at 6:15 PM, Tobias Gondrom 
>>>> <[email-masked] <mailto:[email-masked]>> wrote:
>>>>
>>>>
>>>> security area directors. Document editors and WG chairs should 
>>>> treat these comments just like any other last call comments.
>>>>
>>>>
>>>> The draft is informational and identifies and analyses gaps that 
>>>> must be addressed in order to allow MPLS-related protocols and 
>>>> applications to be used with IPv6-only networks.
>>>>
>>>> changing the address family used for MPLS network operation does 
>>>> not fundamentally alter the security considerations of the existing 
>>>> protocol. Which is basically correct. It could have been 
>>>> interesting to look at the gaps analysis from a security 
>>>> perspective and see which of the MPLS IPv6-only gaps has security 
>>>> implications that need to be addressed. I.e. which gaps are 
>>>> security related. However, that is not essential.
>>>>
>>> Ack.
>>>
>>>> Comment:
>>>> the sentence "This document is not intended to highlight a 
>>>> particular vendor's implementation (or lack thereof)" sounds odd. 
>>>> Is there a WG discussion background or why is this document 
>>>> speaking of one "particular vendor's implementation”?
>>> We just wanted to proactively clarify that this gap analysis is one 
>>> on specifications and not in implementations. The important part of 
>>> that sentence is what follows: “, but rather to focus on gaps in the 
>>> standards defining the MPLS suite."
>>
>> Actually the wording "a particular" might give a strange impression. 
>> It might just be me being paranoid or overly curious, but if I read a 
>> document explicitly denies something, it makes me curious as to why 
>> it does so and whether there was an according aspect behind it. 
>> Otherwise, why would a document explicitly deny something. ;-)
>> particular vendor's implementation" it gives the feeling as if it 
>> might have started as looking at one particular vendor.
>>
>> If you like to clarify the message as you described in your answer, 
>> you might want to rephrase by removing the "a" before "particular" or 
>> phrase it in a positive way as like ".... is about specifications and 
>> not about particular vendor implementations..."
>>
>> Just a thought.
>>
>
> I agree with you, it’s a good thought. We can turn around in a 
> positive way, and remove the “a”, like this:
>