[pcp] Stephen Farrell's Discuss on draft-ietf-pcp-third-party-id-option-04: (with DISCUSS and COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-pcp-third-party-id-option-04: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pcp-third-party-id-option/



----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------


(1) The THIRD_PARTY stuff in PCP was always a bit concerning
from a security point of view. RFC 6887 says that you MUST NOT
implement or use that except in some specific environments. At
the time we would have liked to say that you MUST use PCP
authentication when using that but RFC 7652 wasn't done until
some time later. My DISCUSS question though is: why can't you
distinguish based on a Key ID used with PCP authentication?
Wouldn't that help with the privacy concerns (one can manage
Key IDs well if one wants) and also with the secrity concerns,
and I would guess it should solve the tunnel issues that this
is intended to address as well? (There may be good reasons why
that doesn't work of course, but I'd like to understand them.)

(2) Section 7: The "must be fully trusted" phrase is not a good
one to use - iirc that was a compromise figured out to allow
PCP to proceed ahead of the PCP auth spec.  And of course, it's
really a nonsense. I think you should properly characterise the
issues or else delete the unfortunate phrase. I also think you
should not encourage the use of this for carrying location or
profile information.  What "Means" exist that could be used to
really protect this? And why do you want to "protect
unauthorized access"? that's oddly phrased at best. All in all
I think you need better text for section 7, and I'm happy to
try help find that.


----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------


I share the concerns relating to possible use of long
term identifiers here and thus support the DISCUSSes from
Alissa and Joel.