[ippm] Secdir last call review of draft-ietf-ippm-stamp-on-lag-05

[Nancy Cam-Winget via Datatracker <[e-mail]>]

Reviewer: Nancy Cam-Winget
Review result: Has Issues

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.


This document defines an extension to the Simple Two-Way Active 
Measurement Protocol (STAMP) to facilitate performance measurement
on every member link of a tag.  As such, the proposed extension is
to define a Micro-session identifier and a Session-Reflector member
link identifier.

Issue:
As this draft is now exposing identifiers to the actual nodes in 
the link, there must be inclusions that describe the potential exposure
of these nodes given their identifiers are now explicitly communicated.
RFC 8762 only addresses the integrity not the confidentiality of the
information disclosed which with the session identifier now needs
to be considered.  In addition, privacy considerations describing
the potential consequences of this disclosure can lead to.