Re: [Pce] Shepherd/LC review of draft-ietf-pce-applicability-actn-08

["Adrian Farrel" <[e-mail]>]

Hello,

Speedy reply from you: thanks.

> Thanks for your shepherd/LC review of this draft. Here's our comment
> (inline under YL>>). 
>
> Diff file is also provided for your verifications of all the changes between
> v.8 and v.9.

OK. But (obviously?) please wait until the end of last call as other people may be reviewing and don't want a moving target.

> Let us know if this would make you satisfied. 

Satisfied? Me?
I think you may be mistaking me for someone with a sunny disposition and positive outlook 😊

Snipped and in line...

>> Is Figure 1 any different from Figure 2 of RFC 8453?  If it is the same,
>> why do you need to repeat it here?
>
> YL>> Perhaps adding the text would clarify: 
>
> OLD: The ACTN reference architecture identified a three-tier control
>   hierarchy as depicted in Figure 1:
>
> NEW: The ACTN reference architecture is shown in Figure 1 for the convenience.
> It identifies a three-tier control hierarchy as depicted in Figure 1:

I see your intent. How about...

The ACTN reference architecture is shown in Figure 1 which is reproduced here from [RFC8453] for convenience. [RFC8453] remains the definitive reference for the ACTN architecture. As depicted in Figure 1, the ACTN architecture identifies a three-tier hierarchy.

---

>> 6.
>> 
>> I think you need to do a little more work. The first paragraph nicely lists the relevant
>> security requirements. I think you need to say how each of these is met by security 
>> in PCEP. The second paragraph does mention how to secure PCEP, but doesn't
>> make it clear whether this addresses the requirements.
>
> YL>> I would add a sentence as follows in the end of the first paragraph.
>
> NEW: The security considerations discussed in [RFC5440] are relevant for
>   this document, this document does not introduce any new security
>   issues. 

Weeeeeeeeell, I see what you want to do, but I don't quite buy this approach. It is true that it doesn't of itself introduce any security issues, but does it leave the ACTN security issues unresolved or not?

You say that RFC8453 "lists various security considerations such as request and control of resources, confidentially of the information, and availability of function which should be taken into consideration." So you really should take them into consideration. 8453 has a very substantial security section, and what you have to do is pick the points that it identifies and for each say...
- This consideration is not relevant to the use of PCE because it applies to a component that is remote from the PCE
- This consideration applies to the use of PCE and can be addressed through the use of <foo>
- This consideration applies to the use of PCE, but is not currently addressed. New features will need to be developed.

I know this is a bit of work, but the Security reviewers will (should?) require us to do it, so it is better to try now.


Thanks for all the work.
Adrian