[secdir] Secdir review of draft-ietf-karp-ops-mode-09

[Radia Perlman <[e-mail]>]

I previously reviewed version -07.  This version (-09) is slightly updated.
 I'd requested an introduction about what is different for "routing
protocol security" rather than, say, an endnode authenticating to an access
point.  The authors did add a sentence or so:

" routers need to function in order to

   establish network connectivity.  As a result, centralized services
   cannot typically be used for authentication or other security tasks;
   see Section 4.4.  In addition, routers' roles affect how new routers
   are installed and how problems are handleded;"


There's a couple of typos in the added sentences.  "routers" should be
capitalized.  "Handleded" is a typo.


I don't have any objections to the document.


Radia




On Tue, Aug 13, 2013 at 10:02 PM, Radia Perlman <[e-mail]>wrote:

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
>  These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> This is a useful document as an informational RFC. The technical content
> is interesting and useful.
>
> I think the document would be much improved with an introduction about
> what is different for "routing protocol security" rather than, say, an
> endnode authenticating to an access point, or nodes forming a peer
> relationship in an overlay network.  So, for instance, "normal security
> issues" (i.e., outside the scope of KARP) might assume the network is up,
> so that it's possible to get CRLs, or be available to be managed, whereas
> perhaps KARP is targetting cases which depend on less infrastructure.  It
> would be nice if this document were to have an introduction that talks
> about things like that.
>
> As for typos...3rd line up from bottom of page 14 has a glitch involving a
> bunch of spaces and an extra comma after the word "peers".  And I can't
> parse the last sentence of the 1st paragraph of section 7. "...complexity
> of and update and risk...."
>
> Speaking of PKI...the document talks about certificates expiring, but not
> being revoked (CRL, OCSP).
>
> Radia
>