Re: [secdir] Secdir telechat review of draft-ietf-core-resource-directory-25

Thanks for the reviews, Valery and Adam!

Like Roman, I filed a Discuss ballot with questions about the authorization
model, including whether transport security such as (D)TLS can/should be
assumed, as you pointed out.  (I also mentioned that the discussion of NTP
DDoS seems out of place...)

-Ben

On Sun, Aug 09, 2020 at 11:47:23PM -0700, Valery Smyslov via Datatracker wrote:
> Reviewer: Valery Smyslov
> Review result: Ready
> 
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
>  Document editors and WG chairs should treat these comments just like any other
> last call comments.
> 
> The -24 version of this draft was reviewed by Adam Montville. I looked over his
> review and I think that the issue he raised about possible  mitigation of DDoS
> amplification attacks has been addressed in this version. I personally think
> that sentences describing how DNS and NTP are vulnerable to amplification
> attacks are redundant in this document, but that's a matter of taste and
> doesn't hurt.
> 
> It is my impression, that Security Considerations were mostly written having in
> mind that (D)TLS is always used, however it is only "SHOULD" in this draft (or
> even "MAY" if we look at RFC6690 which Security Considerations this draft
> refers to). I think that adding a few words describing which consequences for
> security not using (D)TLS would have and in which cases it is allowed will make
> the Security Considerations more consistent.
> 
> 
> 
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview