Re: [Detnet] WG Last Call: draft-ietf-detnet-security-09 - David Black's initial comments

[Lou Berger <[e-mail]>]

Hi David,


----------
On April 21, 2020 7:05:49 PM "Black, David" <[e-mail]> wrote:

> Hi Lou,
>
>> The working group last call ends on April 4.
>> Please send your comments to the working group mailing list.
>
> Surely May 4 was intended ... as a WG chair, I've been there ... and been 
> off by much more than one month :-).
>

Correct - others pointed it out too:-)

I'll leave the rest of your comments to the authors...

Cheers
Lou

> Here are some initial relatively high-level comments (I may have more to 
> add after a detailed read):
>
> [1-Editorial] The relationship to RFC 7384 deserves more mention.   A 
> statement towards the end of the introduction to indicate that the threat 
> model and the structure of at least the threat analysis are similar because 
> of the importance of time to the security of both time protocols and DetNet 
> would be good to add.
>
> [2-Minor] In section 4, I suggest removing the discussion of Effects and 
> the Effects rows in the table, as they don't appear to play much of a role 
> in the draft.
>
> [3-Editorial] This draft uses a lot of internal cross references to other 
> sections, e.g., in the Related Attacks discussions in section 5.  It would 
> be helpful to the reader to include section names and/or short description 
> of the contents of the referenced section with each cross reference.
>
> [4-Minor] Sections 5.1 and 5.2 should state that path replication and 
> elimination are not available in the IP data plane
>
> [5-Major] Section 5.8 seems incomplete.   It contains a sizeable summary 
> table of attacks, impacts and mitigations, but doesn't provide 
> recommendations on what to do.  Scanning the mitigations column, a good 
> start would be to characterize control message protection and performance 
> analytics as [MUST implement, SHOULD use] and the combination of DetNet 
> authentication and integrity protection as [MUST implement, MAY use].   
> Both "MUST" requirements are my initial take that I'd be happy to discuss 
> further.
>
> [6-Major] Section 7.1 on the IP data plane seems rather weak - I'm not sure 
> whether it says anything that's seriously useful.  Section 7.2 on the MPLS 
> data plane is much better in directing the reader to relevant security 
> considerations in other documents.
>
> Thanks, --David
>
>> -----Original Message-----
>> From: detnet <[e-mail]> On Behalf Of Lou Berger
>> Sent: Monday, April 20, 2020 11:01 AM
>> To: DetNet WG
>> Subject: [Detnet] WG Last Call: draft-ietf-detnet-security-09
>> 
>> 
>> [EXTERNAL EMAIL]
>> 
>> All,
>> 
>> This starts a two-week working group last call for
>> draft-ietf-detnet-security-09
>> 
>> The working group last call ends on April 4.
>> Please send your comments to the working group mailing list.
>> 
>> Positive comments, e.g., "I've reviewed this document
>> and believe it is ready for publication", are welcome!
>> This is useful and important, even from authors.
>> 
>> Thank you,
>> Lou (DetNet Co-Chair & doc Shepherd)
>> 
>> _______________________________________________
>> detnet mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/detnet
>
> _______________________________________________
> detnet mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/detnet
>