Re: [secdir] secdir review of draft-ietf-tsvwg-port-use

[Joe Touch <[e-mail]>]

Hi, Dan,

It should be easy to add DTLS where TLS is cited. IPsec is an 
interesting issue; I can add a few sentences to the security 
considerations area about that - e.g., that IPsec protects in a 
different way than TLS/DTLS, and that one key aspect of its 
configuration is port-specific parameters, which means it may be 
difficult to use separate IPsec policies on different services unless 
their port numbers are known and fixed in advance (even if using dynamic 
port numbers).

That latter is probably 2-3 short sentences, and I think would be 
worthwhile.

Joe

On 1/30/2015 4:04 PM, Dan Harkins wrote:
>
>    Hello,
>
>    I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
>    This draft provides some advice and recommendations on protocol
> port use to application and service designers. It has a nice, brief
> history of port usage and a nice list of guiding principles to help
> conserve port space. It will make a nice BCP. In my opinion it is Ready
> For Publication. With that said, I do have a small comment. In section
> 7.4 the draft says that TLS should be used to protect services that do
> not provide their own security directly. It might be worth while adding
> mention of DTLS and IPsec. And if the latter is not something that
> should be recommended then justification for that stance should be
> given.
>
>    regards,
>
>    Dan.
>