Re: [dna] next steps on draft-ietf-dna-simple

["Bernard Aboba" <[e-mail]>]

> 3) An additional security consideration issue was brought in secdir
review.
> 
>   Please add the following text to the end of the security
>   considerations section:
> 
>   The DNA procedure does not in itself provide positive, secure 
>   authentication of the router(s) on the network, or authentication of
>   the network itself, as e.g. would be provided by mutual authentication
>   at the link layer. Therefore when such assurance is not available, the
>   host MUST NOT make any security-sensitive decisions based on the DNA
>   procedure. In particular, it MUST NOT decide it has rejoined a network
>   known to be physically secure, and proceed to abandon cryptographic
>   protection.

This text doesn't make sense.  In the case where DNA is based on SEND, DNA
does provide positive,
secure authentication of the router(s) on the network.  Also, the document
describes how 
secure address determination, where present, takes precedence over DNA.