[secdir] Re: draft-ietf-tvr-requirements-08 ietf last call Secdir review

["King, Daniel" <[e-mail]>]

Hi Sean,

Many thanks for your SEC-DIR review of draft-ietf-tvr-requirements-08, and confirming the document is ready from a security perspective.

Yup, we take the point that publishing requirements before the corresponding protocol work carries a risk. We judged that documenting the requirements now provides necessary guidance to the ongoing solution work [enter stage left draft-ietf-tvr-schedule-yang]. There is now work on an applicability document [draft-ietf-tvr-applicability] which will help us catch issues, and hopefully find these requirements are solvable.
	
To answer your other specific comments:

Section 2.1.2: The text now uses "intermediate schedule" consistently, rather than "intermediate situation", to aid searchability.

Section 6.2: "The schedule ability" has been corrected to "The schedule availability".

Thank you again for taking the time to review the document.

BR, Dan.

-----Original Message-----
From: Sean Turner via Datatracker <[e-mail]> 
Sent: 20 April 2026 21:22
To: [e-mail]
Cc: [e-mail]; [e-mail]; [e-mail]
Subject: [secdir] draft-ietf-tvr-requirements-08 ietf last call Secdir review

Document: draft-ietf-tvr-requirements
Title: Time-Variant Routing (TVR) Requirements
Reviewer: Sean Turner
Review result: Ready

Apologies for being tardy.

I reviewed the other Directorate comments and the SecADs comments. I do not really have anything of substance to add. But, I will offer my normal warning when publishing a requirements draft before you're done with the protocol - you might want to hold off on publishing this draft until the actual protocol gets done just in case you find out you can't meet you're requirements. Nothing like doing a bis to remove a requirement.

Nits:

0) s2.1.2: Contains this: "There is also the possibility of an intermediate situation ..." But, later (and earlier) I think the term “intermediate schedule” is used. Rephrasing the sentence in s2.1.2 to refer to “intermediate schedule”, I think, might help if people are searching on that term.

1) s6.2: Should "ability" be "availability" in the following: "The schedule ability could enable attackers to launch highly targeted attacks ..."