Re: [secdir] SecDir review of draft-ietf-pce-gmpls-aps-req-08

["Adrian Farrel" <[e-mail]>]

Hi,

Thanks Yaron.

You're right about pointing to 5440. That document notes that TCP-AO should be
used once it becomes available, and since it has done, a pointer to RFC 6952
would also be helpful.

Cheers,
Adrian

> -----Original Message-----
> From: [e-mail] [mailto:[e-mail]] On Behalf Of Yaron
> Sheffer
> Sent: 16 June 2013 21:11
> To: IETF Security Directorate; The IESG; draft-ietf-pce-gmpls-aps-
> [e-mail]
> Subject: SecDir review of draft-ietf-pce-gmpls-aps-req-08
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
> This document defines additional GMPLS-specific requirements on the PCE
> architecture.
> 
> It would be an understatement to characterize this reviewer as a
> non-expert on PCE and GMPLS. That being said, I believe the Security
> Considerations are correct in saying that this document does not add any
> additional security issues on top of PCE.
> 
> I would recommend to add a pointer to where such considerations are in
> fact listed, e.g. Sec. 10 of RFC 5440. Though security folks will cringe
> at TCP-MD5 being described as the most practical security solution in
> that section.
> 
> Thanks,
> 	Yaron