[pcp] Terry Manderson's No Objection on draft-ietf-pcp-authentication-13: (with COMMENT)

["Terry Manderson" <[e-mail]>]

Terry Manderson has entered the following ballot position for
draft-ietf-pcp-authentication-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for addressing an aspect of security in relation to PCP,
especially the Advanced Threat Model from RFC6887.

I have a few comments

1) I'm sure the RFC editor will pick these up, however there is some
comma usage in the document that caused me to re-read some of the
paragraphs to understand. The Abstract is one example of this. I'm
certainly no expert so perhaps have a skim over this:
http://www.grammarbook.com/punctuation/commas.asp

2) s 3.1.1, please consider rewording the text "Section 5.1 updates the
PCP request message format to have a result code." to something like
"Section 5.1 updates the PCP request message format with result codes for
the PCP Authentication mechanism" ...The wording as it stands seems a
little non-specific.

3) Basic DoS attacks (such as state bloat) are mentioned in the security
section, are there any complex DoS attacks that can be leveraged using
the PCP authentication mechanism itself?