[conex] Stephen Farrell's No Objection on draft-ietf-conex-destopt-09: (with COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-conex-destopt-09: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-conex-destopt/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


- section 7: "If the transport network cannot be trusted, IPsec
Authentication should be used to ensure integrity of the ConEx
information." Hmm. Transport networks cannot be trusted so the
first condition is always met. That means you are saying IPsec
should be used. I don't see how the key management required is
going to happen and even if it did, would that affect conex
calculations? I'm ok with an experiment on that basis though, 
but it'd be better if the real relationship between this and IPsec
were more fully fleshed out somewhere as part of the experiment.

- The secdir review [1] touches on similar issues. I'm not sure if
that got a response, but it raises a good point that seems to me to
deserve a response.

   [1] https://www.ietf.org/mail-archive/web/secdir/current/msg05957.html