From nobody Thu Dec 31 11:41:13 2020 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 4C3A73A08A9 for ; Thu, 31 Dec 2020 11:41:11 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.898 X-Spam-Level: X-Spam-Status: No, score=-1.898 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TzQ7BQZTRUS4 for ; Thu, 31 Dec 2020 11:41:10 -0800 (PST) Received: from smtp127.iad3a.emailsrvr.com (smtp127.iad3a.emailsrvr.com [173.203.187.127]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 1E5AB3A08A5 for ; Thu, 31 Dec 2020 11:41:10 -0800 (PST) Received: from app12.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140]) by smtp32.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 31218429D; Thu, 31 Dec 2020 14:41:09 -0500 (EST) Received: from hyperthought.com (localhost.localdomain [127.0.0.1]) by app12.wa-webapps.iad3a (Postfix) with ESMTP id 1E824E0FA2; Thu, 31 Dec 2020 14:41:09 -0500 (EST) Received: by apps.rackspace.com (Authenticated sender: scott@hyperthought.com, from: scott@hyperthought.com) with HTTP; Thu, 31 Dec 2020 11:41:09 -0800 (PST) X-Auth-ID: scott@hyperthought.com Date: Thu, 31 Dec 2020 11:41:09 -0800 (PST) From: "Scott G. Kelly" To: "secdir@ietf.org" , "iesg@ietf.org" , draft-ietf-pce-association-policy.all@ietf.org MIME-Version: 1.0 Content-Type: text/plain;charset=UTF-8 Content-Transfer-Encoding: quoted-printable Importance: Normal X-Priority: 3 (Normal) X-Type: plain X-Client-IP: 24.23.138.127 Message-ID: <1609443669.12212399@apps.rackspace.com> X-Mailer: webmail/18.1.10-RC X-Classification-ID: ffcb51c0-a5e3-4125-baf7-6c2f4839a4d7-1-1 Archived-At: Subject: [secdir] secdir review of draft-ietf-pce-association-policy-15 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 31 Dec 2020 19:41:11 -0000 I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments.=0A=0AThe summary of the review is ready.=0A=0AF= rom the abstract, this document introduces a simple mechanism to associate = policies to a group of Label Switched Paths (LSPs) via an extension to the = Path Computation Element (PCE) Communication Protocol (PCEP).=0A=0AThe secu= rity considerations section references security considerations from RFCs 53= 94, 5440, 8231, 8281, 8408, and 8697. In addition, it recommends securing s= essions with TLS in accordance with RFCs 8253 and 7525.=0A=0ABecause this p= rotocol extension utilizes TLVs, there is an explicit call for care in deco= ding and utilizing these TLVs due to the potential for attack via malformed= payloads.=0A=0AI'm not a routing expert, but I think the authors have adeq= uately covered security considerations for this extension.