[secdir] Secdir last call review of draft-ietf-grow-bmp-adj-rib-out-06

[Catherine Meadows via Datatracker <[e-mail]>]

Reviewer: Catherine Meadows
Review result: Not Ready

This draft describes describes a modification of BGP Monitoring Protocol to
allow it access to the Adj-RIB-Out Routing Information Bases.  It already has
access to the  Adj-RIB-In.  According to  RFC4271  these are defined as
follows: ”The Adj-RIBs-In contains unprocessed routing information that has
been advertised to the local BGP speaker by its peers"   and "The Adj-RIBs-Out
contains the routes for advertisement to specific peers by means of the local
speaker’s UPDATE messages.”   The procedure by which BMP sends  Adj-RIBS-Out is
similar to  that which by which it sends Adj-RIBS-In.

The Security Considerations Section consists of the following statement:

It is not believed that this document adds any additional security
considerations.

This is not enough.  First, you need to say additional security considerations
beyond what.  This can best be done by referencing one or more RFCs.  In this
case it would be RFC 7854, and perhaps RFC 4271.  e.g.

This document does not add any  additional security considerations beyond those
already covered RFC 7854.

Secondly, you need to say why it doesn’t introduce any new security
considerations.  In both Adj-RIBS-In and Out cases the information sent is
routing information.  Would there be any new security considerations involved
in sharing routing information sent in UPDATE messages vs. advertisements?  If
not, why not?