RE: Comments on draft-ietf-bfd-generic-crypto-auth

["Nobo Akiya (nobo)" <[e-mail]>]

Hi Mahesh,

Thanks for considering my comments.

> > (3) Section 3.3
> >
> > [snip]
> >   The device MUST fill the Auth Type and the Auth Len fields before the
> >   authentication data is computed.  The Sequence Number field MUST be
> >   set to bfd.XmitAuthSeq.
> > [snip]
> >
> > The paragraph is slightly confusing wrt whether Sequence Number field
> need to be set before or after authentication data is computed. It'll be good
> to clarify this.
> 
> 
> I was looking at RFC 5880 for guidance on this. It says "The Sequence
> Number field MUST be set to bfd.XmitAuthSeq." Period. No mention of
> before or after.
> 
> How about this:
> "The device MUST fill the Auth Type, the Auth Len fields and set the
> Sequence Number field to bfd.XmitAuthSeq before the authentication data
> is computed."

That is much clearer.

> > (6) Section 3.4, sixth paragraph
> >
> > [snip]
> >  In such a case, an error event SHOULD be logged.
> > [snip]
> >
> > Such log could become DoS attack point? Rate limiting of such log is
> outside the scope of this document, but it could be beneficial to explain this
> in the Security Considerations section ... optional comment though.
> >
> 
> How about this:
> 
> "In such a case, an error event SHOULD be logged. Rate limiting of such a log
> to prevent a DoS attack is outside the scope of this document."

Changes does imply that rate limiting should be applied. However, considering these logs could be generated for every BFD packet received by the system (which can be significant amount), it may be better to explicitly have a paragraph on this in the Security Consideration section. Perhaps this can be taken up as a next next revision?

-Nobo