Re: [secdir] secdir review of draft-ietf-mpls-ipv6-only-gap-02

[Tobias Gondrom <[e-mail]>]

Carlos,

thanks for your reply.
One note inline.

On 29/10/14 01:49, Carlos Pignataro (cpignata) wrote:
> Tobias,
>
> Many thanks for your review, and apologies for a delayed response. Please see inline.
>
>> On Oct 22, 2014, at 6:15 PM, Tobias Gondrom <[e-mail]> wrote:
>>
>>
>> I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.
>>
>>
>> The draft is informational and identifies and analyses gaps that must be addressed in order to allow MPLS-related protocols and applications to be used with IPv6-only networks.
>>
>> The document appears ready for publication.
> Thanks!
>
>> The security considerations section (section 8) only states that changing the address family used for MPLS network operation does not fundamentally alter the security considerations of the existing protocol. Which is basically correct. It could have been interesting to look at the gaps analysis from a security perspective and see which of the MPLS IPv6-only gaps has security implications that need to be addressed. I.e. which gaps are security related. However, that is not essential.
>>
> Ack.
>
>> Comment:
>> 1. Abstract and Section 1:
>> the sentence "This document is not intended to highlight a particular vendor's implementation (or lack thereof)" sounds odd. Is there a WG discussion background or why is this document speaking of one "particular vendor's implementation”?
> We just wanted to proactively clarify that this gap analysis is one on specifications and not in implementations. The important part of that sentence is what follows: “, but rather to focus on gaps in the standards defining the MPLS suite."

I fully understand and saw the following sentence.
Just to explain further why I felt the sentence is odd:
Actually the wording "a particular" might give a strange impression. It 
might just be me being paranoid or overly curious, but if I read a 
document explicitly denies something, it makes me curious as to why it 
does so and whether there was an according aspect behind it. Otherwise, 
why would a document explicitly deny something. ;-)
E.g. if the document speaks about "not intended to highlight a 
particular vendor's implementation" it gives the feeling as if it might 
have started as looking at one particular vendor.

If you like to clarify the message as you described in your answer, you 
might want to rephrase by removing the "a" before "particular" or phrase 
it in a positive way as like ".... is about specifications and not about 
particular vendor implementations..."

Just a thought.

Best, Tobias


>
>> Nits:
>> - section 3.3.1.1. EVPN
>> formating: do you want to add one line at the end of the section: "Gap: Minor….
>> “
>>
> Good catch — fixed.
Thanks.
>
>
>> I did not find anything else in my review.
>>
>>
>
> Thanks!
>
> Carlos.
>
>> Thank you and best regards.
>>
>> Tobias
>>