[secdir] Secdir telechat review of draft-ietf-bier-ospf-bier-extensions-11

[Adam Montville <[e-mail]>]

Reviewer: Adam Montville
Review result: Not Ready

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

The security ADs may prefer to see an elaborated Security Considerations
section. From my perspective, the single sentence seeking to ensure that
malformed TLV and Sub-TLV permutations don't result in hard OSPF failures is
insufficient. What could be the outcome of such hard failures (i.e. what does
an implementer need to understand about not heeding such considerations)? Also,
a reader might presume that there are no additional BIER security
considerations not otherwise handled in RFCs 8279 and 8296 respectively. If
such a presumption is correct, then I would recommend explicitly stating so and
perhaps even referring the reader to those Security Considerations for anything
that may apply to this extension. Finally, in the first sentence of the
Security Considerations, there exists "must" - is that intended to be MUST?

I don't have any further comments on this draft from a nit perspective nor from
an efficacy perspective when it comes to routing, as this isn't my area of
expertise.

Kind regards,

Adam