[pcp] Stephen Farrell's No Objection on draft-ietf-pcp-anycast-07: (with COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-pcp-anycast-07: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pcp-anycast/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


Say if PCP authentication is supported and the PCP client can
authenticate with various different PCP servers, e.g. at home
and in the office. Imagine further that the secrets for the
home PCP authentication leak (or are guessed). Wouldn't we
want the PCP client in the office in such a case to not accept
a PCP server that uses the home secrets? Is that scenario
possible? If so, and if the PCP client has some way to know
that it is at home or in the office, (could it?), shouldn't
there be some security considerations text saying to not
accept authenticated responses that come from the "wrong" PCP
server? That would probably mean extending the last paragraph
of 5.2 to say "if the client knows what server it expects to
authenticate to it after the anycast request was sent, then
the client MUST check that the response is authenticated from
that server (and not some other)."

Separately, I hate one of the arguments used (twice!) in 5.2.
What you are saying is "I don't need to do stuff because worse
things can happen." If all protocol developers made that
argument then we would never improve security or privacy.
It's a bad argument. You need instead to argue that there's
really nothing practical than can be done and that would be
used and that would improve over doing nothing.