Re: [secdir] [Last-Call] Secdir telechat review of draft-ietf-dtn-tcpclv4-18

["Christopher Wood" <[e-mail]>]

My pleasure! I’m glad it helped.

Best,
Chris 

On Thu, Feb 20, 2020, at 9:33 AM, Benjamin Kaduk wrote:
> Hi Chris,
> 
> Thanks for doing this and the initial review; that helped the document out
> quite a bit!  (I did still have a couple discuss points, but they're
> largely about high-level topics relating to how much policy should be
> encoded in the protocol spec.)
> 
> -Ben
> 
> On Thu, Feb 13, 2020 at 06:54:47PM -0800, Christopher Wood via 
> Datatracker wrote:
> > Reviewer: Christopher Wood
> > Review result: Has Nits
> > 
> > Thanks for updating this document! All of my comments from the previous review
> > have been addressed. It reads much better now. I only have some minor nits to
> > note below:
> > 
> > - Section 8.5: This section title references ciphersuite downgrade, yet the
> > text refers to configured use of less-good ciphersuites. Perhaps the title
> > should be, "Threat: Weak TLS Configurations"? - Section 8.6: I don't quite
> > follow this section. Certainly, describing how one validates certificates is
> > out of scope. However, the title suggests this is part of how one "uses"
> > certificates? I might just scratch this section altogether, and instead
> > reference RFC5280 where certificate-based authentication is first presented. -
> > Section 8.7: I might rename this title to, "Threat: Symmetric Key Limits." -
> > Section 8.10.1: I would reference opportunistic security here, as an
> > unauthenticated key exchange yields similar properties.
> > 
> > -- 
> > last-call mailing list
> > [e-mail]
> > https://www.ietf.org/mailman/listinfo/last-call
>