Re: [pcp] Terry Manderson's No Objection on draft-ietf-pcp-authentication-13: (with COMMENT)

> -----Original Message-----
> From: pcp [mailto:pcp-bounces@ietf.org] On Behalf Of Terry Manderson
> Sent: Wednesday, July 08, 2015 8:28 AM
> To: The IESG
> Cc: pcp@ietf.org
> Subject: [pcp] Terry Manderson's No Objection on draft-ietf-pcp-
> authentication-13: (with COMMENT)
> 
> Terry Manderson has entered the following ballot position for
> draft-ietf-pcp-authentication-13: No Objection
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
> for more information about IESG DISCUSS and COMMENT positions.
> 
> 
> The document, along with other ballot positions, can be found here:
> https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/
> 
> 
> 
> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thanks for addressing an aspect of security in relation to PCP, especially the
> Advanced Threat Model from RFC6887.
> 
> I have a few comments
> 
> 1) I'm sure the RFC editor will pick these up, however there is some comma
> usage in the document that caused me to re-read some of the paragraphs to
> understand. The Abstract is one example of this. I'm certainly no expert so
> perhaps have a skim over this:
> http://www.grammarbook.com/punctuation/commas.asp
> 
> 2) s 3.1.1, please consider rewording the text "Section 5.1 updates the PCP
> request message format to have a result code." to something like "Section 5.1
> updates the PCP request message format with result codes for the PCP
> Authentication mechanism" ...The wording as it stands seems a little non-
> specific.

Thanks, fixed in my local copy.

> 
> 3) Basic DoS attacks (such as state bloat) are mentioned in the security section,
> are there any complex DoS attacks that can be leveraged using the PCP
> authentication mechanism itself ?

I don't think so. Attack on PCP authentication depends on the EAP method used, for example if TEAP is used various possible DoS attacks and mitigations are discussed in TEAP protocol https://tools.ietf.org/html/rfc7170.

-Tiru

> 
> 
> _______________________________________________
> pcp mailing list
> pcp@ietf.org
> https://www.ietf.org/mailman/listinfo/pcp