[secdir] draft-ietf-pce-flexible-grid-16 ietf last call Secdir review

[Yoav Nir via Datatracker <[e-mail]>]

Document: draft-ietf-pce-flexible-grid
Title: PCEP Extension for Flexible Grid Networks
Reviewer: Yoav Nir
Review result: Has Nits

This review is limited by my lack of knowledge about PCEP.

I'll start with a Gen-Art comment, that the document references RFC 8253 (TLS
for PCEP), but that document has been updated by RFC 9916 (using TLS 1.3 for
PCEP), so this document should reference that as well. In any case, TLS is only
mentioned once, in the security considerations section.

The Security Considerations section is quite short, and mostly by-reference,
stating that it "has no requirement for a change to the security models within
PCEP" and that "the security considerations described in [RFC5440] and the use
of TLS to provide a secure transport for PCEP as described in [RFC8253] apply
to the extensions defined in this document". Fair enough, but RFC 5440 (PCEP)
is from 2009, and contains such advice as that "TCP-MD5 [RFC2385] is the only
available security mechanism for securing the TCP connections", and nowhere in
this document is the use of TLS mandated.

The Security Considerations section goes on to say that the "additional
information distributed in order to address the RSA problem represents a
disclosure of network capabilities that an operator might wish to keep private.
Operators are encouraged to secure this information"  I don't know what
"encouraged" means here. Either the information in this extension is more
sensitive than general PCEP information, and TLS is a MUST or a SHOULD, or it's
similar to other information, and so using TLS remains optional. I think the
document (though probably not the Security Considerations section) should say
one way or the other. Nowhere else in the document is security, privacy, or
disclosure mentioned.