[secdir] Secdir last call review of draft-ietf-6lo-use-cases-12

[Robert Sparks via Datatracker <[e-mail]>]

Reviewer: Robert Sparks
Review result: Has Issues

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These comments
were written primarily for the benefit of the security area directors. Document
editors and WG chairs should treat these comments just like any other last call
comments.

This document has issues to address before publication as an Informational RFC

Issues:

>From the abstract: "The document targets an audience who would like to
understand and evaluate running end-to-end IPv6 over the constrained node
networks for local or Internet connectivity."

Its security considerations section claims "Security considerations are not
directly applicable to this document". Yet the text of the draft has several
places that rightly call out thing like "there exist implications for privacy",
"privacy also becomes a serious issue", and "the assumption is that L2 security
must be present." A summary of these things in the security considerations
section seems prudent. At _least_ call out again the assumption about L2
security.

The "Security Requirement"A summary of these things in the security
considerations section seems prudent. At _least_ call out again the assumption
about L2 security.

The "Security Requirement" row in Table 2 is not well explained. The values in
that row are explained at all. (For instance, the word "Partially" appears
exactly once in the document - it is unclear what it means).

Nits/Comments:

Appendix A is neither introduced nor referenced from the body of the document.
Why is it here?

I'm a little concerned about some of the technology descriptions possibly
moving beyond simple facts into interpretation or even marketing. The last
paragraph of section 2.5 is a particularly strong example. Look for phrases
section 4 that include "targets" or "targeted by" and make sure that's what the
organizations ins that define those technologies say (consider references).

At 'superior "range"', why is range in quotes? Think about restructuring the
sentences that use 'superior' to avoid the connotation of "better than". All
this document really needs to acknowledge is "goes further".