Re: [Pce] RtgDir Early review: draft-ietf-pce-pceps-tls13-02

Sean Turner <> Tue, 05 December 2023 17:34 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id 1DA65C15C29F for <>; Tue, 5 Dec 2023 09:34:07 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.107
X-Spam-Status: No, score=-2.107 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=unavailable autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (1024-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id SuSBkLKoEVY5 for <>; Tue, 5 Dec 2023 09:34:03 -0800 (PST)
Received: from ( [IPv6:2607:f8b0:4864:20::b2e]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by (Postfix) with ESMTPS id 73746C15108B for <>; Tue, 5 Dec 2023 09:34:03 -0800 (PST)
Received: by with SMTP id 3f1490d57ef6-dafe04717baso4333532276.1 for <>; Tue, 05 Dec 2023 09:34:03 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=google; t=1701797642; x=1702402442;; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=mnKsEUcIWp+92LKhHmjweXiETyyC/tBv49mxbzQbhtE=; b=k8nbXGHZUJBy9D55L37UCi6RnCy5HDz0Ebh+Z/umOcZwDXaUbWqV9QLTcp7+ExwONf IkZFXIxNPMmVr5skiifJ/CspbLWsp7P74sw5yGRTtsX5Wg7zUGSi+CygrYOQOygLzLU5 m29XqAJfOm/xe/Z4dHE6zLKX5FnHIbRv45Hkc=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20230601; t=1701797642; x=1702402442; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=mnKsEUcIWp+92LKhHmjweXiETyyC/tBv49mxbzQbhtE=; b=hJJy3rTQsBD9B892WHr/DJ3R+TW4nohuRBvvbbQahwBD9DsYmxI4cKYFn66BmtzJOP p6+HiD0K1UlGW+Cwf7nCx07clRPzJc4nlppXChtWvFr/QrD2QMJ8ncl/DMBDxVBXHUt1 PgYZGaobYiiUl++EqG2pb888fY7YdIus8+n/i6M2gYELvB5x+dTAFcXX+kiXrPwxuMOP 9dVnaslQtQ9QS4Dy3oWsZm/mqlhGYVwaQtf4rIOBZ2TcY60C/v6l+SdKFzWDfTisHV7F vxu3LDyzlB6hw4o8+8eZTGOX7trApipfzpPqZUIjT2fJj65oyyzR3Z7PUE/+uGyO7Rkg +qgQ==
X-Gm-Message-State: AOJu0YyrvXCOrDBZroWnZnz59PqF4ow+8cJHEtV8sex2P0JIJ9fvfQi9 ROt4JXPy93y7fJb7WaR5fsaK+A==
X-Google-Smtp-Source: AGHT+IHOsHGz9/bivOsCBI8oyu95W9Uk0HSxR0aXbyubPbPimYEFL+vaenzKYumRrHp5cUfpM2WetQ==
X-Received: by 2002:a25:838d:0:b0:db5:5020:518a with SMTP id t13-20020a25838d000000b00db55020518amr4707403ybk.4.1701797642342; Tue, 05 Dec 2023 09:34:02 -0800 (PST)
Received: from ( []) by with ESMTPSA id v18-20020ad45292000000b0067aa24efed2sm3912263qvr.73.2023. (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 05 Dec 2023 09:34:01 -0800 (PST)
Content-Type: text/plain; charset="utf-8"
Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.\))
From: Sean Turner <>
In-Reply-To: <>
Date: Tue, 05 Dec 2023 12:34:01 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <>
References: <>
To: Tal Mizrahi <>
X-Mailer: Apple Mail (2.3654.
Archived-At: <>
Subject: Re: [Pce] RtgDir Early review: draft-ietf-pce-pceps-tls13-02
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: Path Computation Element <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Tue, 05 Dec 2023 17:34:07 -0000

> On Nov 13, 2023, at 04:07, Tal Mizrahi <> wrote:
> Hello
> I have been selected to do a routing directorate “early” review of this draft.

Hi! And, thanks for your review. I have created an issue to track this review:

> The routing directorate will, on request from the working group chair,
> perform an “early” review of a draft before it is submitted for
> publication to the IESG. The early review can be performed at any time
> during the draft’s lifetime as a working group document.
> For more information about the Routing Directorate, please see
> Document: draft-ietf-pce-pceps-tls13-02
> Reviewer: Tal Mizrahi
> Review Date: Nov 13, 2023
> Intended Status: Standards Track
> Summary:
> I have some concerns about this document that I think should be
> resolved before it is submitted to the IESG.
> Comments:
> The draft is clear and straightforward. There is one main comment that
> needs to be addressed.
> Major comment:
> The "Security Considerations" section needs to describe the security
> considerations that are specific to the current document. For example,
> the second note of Section 3, and perhaps some more text that explains
> why this is important. The existing text in this section is not
> helpful to the reader. The section cites 9 references with a brief
> description of each reference, but without the description of the
> security considerations of each reference. The last paragraph of the
> section - is it relevant to the current document? It would be best to
> stick with security considerations that are strictly relevant to the
> current document, and not to PCE in general.

Ah yes, I “fixed” the main body and ignored the Security Considerations. I tend to agree we should edit it.

Since this I-D is essentially adding a couple of bullets to an existing RFC, we are adopting all of those considerations and the PCEP considerations. This I-D also addresses TLS 1.2 and TLS 1.3 protocols and recommendations for those protocols. So, that’s the 1st para. Note the WG asked to add more PCEP related security considerations; see:

I tend to think the 2nd and 3rd paragraph can be dropped entirely now.

As for repeating/expanding on the 2nd NOTE in s3: if the text of this I-D was incorporated in a replacement for RFC 8253 and was 10 pages away from the security considerations. I could see repeating/expanding it. As it is right now, that bullet is immediately proceeds the Security Considerations. Further, that text is additionally incorporated by reference from TLS 1.3 and RFC 9325 so I tend to think it’s kind of covered and doesn’t need more text.  Again, I could see repeating the bullet or moving that bullet, but because this document is so short it seems like overkill.

I created a PR that incorporates these changes:

>> ?
>> As for expanding on the 2nd note, I think repeating the text is a bad idea - I’d rather refer there again as follows:
>> As noted in Section 3, Section 2.3 of [I-D.ietf-tls-rfc8446bis] identifies that the security properties for early data are weaker than those for subsequent TLS-protected data. In particular, early data is not forward secret, and there is no protection against the replay of early data between connections.

> Nits:
> - "if a PCEPS supports more than one version" - the sentence is not
> clear. Perhaps "if a PCEPS implementation supports more than one
> version"?
> - Section 4 - second paragraph - there is a missing period at the end
> of the paragraph.

Fixed these via: