[i2rs] Mirja Kühlewind's No Objection on draft-ietf-i2rs-protocol-security-requirements-06: (with COMMENT)

["Mirja Kuehlewind" <[e-mail]>]

Mirja Kühlewind has entered the following ballot position for
draft-ietf-i2rs-protocol-security-requirements-06: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-i2rs-protocol-security-requirements/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

A few comments:

1) I don't think copy&paste from RFC4949 is necessary. I would recommend
to remove this part and just name the definitions that are needed.

2) The following sentence seems to indicate that the refernce to RFC4949
should be normative.
"The transfer of data via the I2RS protocol has the property of data
integrity described in [RFC4949]."
As I don't think this is needed, I would recommend to rather spell out
the properties here in this sentence. Also, to be honstest I not sure
what this sentence tells me at all. So maybe stating clearing what you
mean (instead of just having the reference) would help anyway.

3) To me it's not really clear why there are several requirments docs
(that also are connected and refer each other; see e.g. section 3.6 and
SEC-REQ-16). The actually context of this doc is only 4 pages (3.1-3.6).
Couldn't those docs be combined to one requiremnet doc?

4) Section 3.1 says:
"The I2RS architecture [I-D.ietf-i2rs-architecture] sets the following
requirements:"
Why is this needed is RFC7921 already sets these requirements?