[karp] draft-ietf-karp-bfd-analysis-00 comments

[Jeffrey Haas <[e-mail]>]

I've just read the current version of draft-ietf-karp-bfd-analysis.  I have
one comment and one question:

The draft correctly identifies the potential security implications of
predictable BFD session discriminator values.  The following text in 
RFC 5880 attempts to cover this issue:


   bfd.LocalDiscr

      The local discriminator for this BFD session, used to uniquely
      identify it.  It MUST be unique across all BFD sessions on this
      system, and nonzero.  It SHOULD be set to a random (but still
      unique) value to improve security.  The value is otherwise outside
      the scope of this specification.

Obviously implementations may make choices that are problematic from a
replay standpoint, but I don't believe there is anything to really cover in
a new BFD document.  Do the authors believe otherwise, or is this primarily
pointing out "you know better, don't do that!"

It should also be noted that we have two I-Ds as WG documents that cover the
other issues noted in this draft: draft-ietf-bfd-hmac-sha and
draft-ietf-bfd-generic-crypto-auth.

Presuming my analysis of the above is correct (an admonition to do the right
thing), this document appears of reasonable quality.  Is there an intent to
last call it sometime soon?

-- Jeff