[ippm] Roman Danyliw's No Objection on draft-ietf-ippm-explicit-flow-measurements-03: (with COMMENT)

[Roman Danyliw via Datatracker <[e-mail]>]

Roman Danyliw has entered the following ballot position for
draft-ietf-ippm-explicit-flow-measurements-03: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/about/groups/iesg/statements/handling-ballot-positions/ 
for more information about how to handle DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-ippm-explicit-flow-measurements/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Steve Hanna for the SECDIR review.

** Certain documents previously published out of IPPM were only intended for
closed deployments (sometimes called “limited domains”).  Are the approaches
described in this document intended for the Internet?  It would be helpful to
state the applicability.

** Section 6.  Given that Section 7 reminds the reader that “[a]uthentication
techniques may be used where appropriate to guard against these traffic
attacks”, what would that mean in the context of QUIC and TCP?

** Section 7.  It appears that these measurement fields introduced in the
packet are intended only for the sender and recipient with little information
to any intermediaries.  This seems like a recipe for a covert channel not
inspected by typical security devices.  Consider noting this possibility.