[dtn] Secdir telechat review of draft-ietf-dtn-tcpclv4-18

Christopher Wood via Datatracker <noreply@ietf.org> Fri, 14 February 2020 02:54 UTC

Return-Path: <noreply@ietf.org>
X-Original-To: dtn@ietf.org
Delivered-To: dtn@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id C58EF120059; Thu, 13 Feb 2020 18:54:47 -0800 (PST)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 7bit
From: Christopher Wood via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Cc: last-call@ietf.org, draft-ietf-dtn-tcpclv4.all@ietf.org, dtn@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 6.117.0
Auto-Submitted: auto-generated
Precedence: bulk
Reply-To: Christopher Wood <caw@heapingbits.net>
Message-ID: <158164888774.20556.7623938203569597994@ietfa.amsl.com>
Date: Thu, 13 Feb 2020 18:54:47 -0800
Archived-At: <https://mailarchive.ietf.org/arch/msg/dtn/5Gvccjyk0uX_1O2KnvdPoh9K8us>
Subject: [dtn] Secdir telechat review of draft-ietf-dtn-tcpclv4-18
X-BeenThere: dtn@ietf.org
X-Mailman-Version: 2.1.29
List-Id: "Delay Tolerant Networking \(DTN\) discussion list at the IETF." <dtn.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/dtn>, <mailto:dtn-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/dtn/>
List-Post: <mailto:dtn@ietf.org>
List-Help: <mailto:dtn-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/dtn>, <mailto:dtn-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 14 Feb 2020 02:54:48 -0000

Reviewer: Christopher Wood
Review result: Has Nits

Thanks for updating this document! All of my comments from the previous review
have been addressed. It reads much better now. I only have some minor nits to
note below:

- Section 8.5: This section title references ciphersuite downgrade, yet the
text refers to configured use of less-good ciphersuites. Perhaps the title
should be, "Threat: Weak TLS Configurations"? - Section 8.6: I don't quite
follow this section. Certainly, describing how one validates certificates is
out of scope. However, the title suggests this is part of how one "uses"
certificates? I might just scratch this section altogether, and instead
reference RFC5280 where certificate-based authentication is first presented. -
Section 8.7: I might rename this title to, "Threat: Symmetric Key Limits." -
Section 8.10.1: I would reference opportunistic security here, as an
unauthenticated key exchange yields similar properties.