[pcp] IESG review of draft-ietf-pcp-third-party-id-option-04

[Juergen Quittek <[e-mail]>]

Dear all,

At the IESG telechat on Nov 19 the IESG discussed draft-ietf-pcp-third-party-id-option-04. The ISG raised two main concerns:

1. The draft elaborates use cases where the proposed THIRD_PARTY_ID option is used for carrying an identifier of a tunnel and where it is used in addition to the THIRD_PARTY option that contains the IP address of a third party host. Beyond these use cases, the draft also refers to other protential use cases without elaborating them. The IESG has concerns about opening the THIRD_PARTY_ID option to unspecified use cases, because the implications cannot be foreseen. Particularly security concerns are difficult to address if it is not clear how sensitive information carried by THIRD_PARTY_ID option could be.

2. In light of point one, the IESG request further elaboration of the security considerations.

As potential solution of the issue it was discussed at the IESG telechat to 
- restrict the use of the THIRD_PARTY_ID option in the draft to carrying tunnel IDs only
- add a statement that for using the THIRS_PARTY_ID option for other use cases, a standards document would be needed that specifies this usage.

The authors would be fine with updating the draft following these recommendations. A restriction to tunnel IDs only would also be a good starting point for addressing the security concerns raised by the IESG.

Would people on this list have any concerns about implementing this solution in the next update o the draft?

Best regards,
    Juergen