Re: [secdir] SECDIR review of draft-ietf-eman-energy-aware-mib-15

[Stephen Kent <[e-mail]>]

Juergen,

I read the boilerplate you cited.

The comment re IPsec is misleading, for the reasons I noted in my review.
This is the first MIB I-D I've reviewed. I would have pointed out the 
problems
with that text earlier had I reviewed a MIB earlier :-).

With the publication of RFC 7258 as a BCP its seems appropriate to revisit
the boilerplate when discussing confidentiality and use of encryption. 
Hence
my suggestion that use of encryption be RECOMMENDED.

Since the subject of this MIB is energy management, I think that my 
comments about
the potential adverse impacts of security lapses for these MIBs are 
relevant. This
is outside the generic context for which the boilerplate was developed.

Finally, the boilerplate does not seem to use the same language as the 
text at the end
of the SC, e.g., I don't see the word "consider" in the boilerplate. The 
mix of advice dealing
with implementation vs. deployment still strikes me as confusing, as 
written. I think the
boilerplate text is better in this respect, and should be used as a 
starting point for
the last part of the SC in this I-D (tailored as needed).

Steve