Re: [secdir] Secdir review of draft-ietf-dhc-dhcpv6-radius-opt-11

Ted Lemon <Ted.Lemon@nominum.com> Fri, 17 May 2013 18:52 UTC

Return-Path: <Ted.Lemon@nominum.com>
X-Original-To: secdir@ietfa.amsl.com
Delivered-To: secdir@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 48A1C21F972B; Fri, 17 May 2013 11:52:44 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -106.553
X-Spam-Level:
X-Spam-Status: No, score=-106.553 tagged_above=-999 required=5 tests=[AWL=0.046, BAYES_00=-2.599, RCVD_IN_DNSWL_MED=-4, USER_IN_WHITELIST=-100]
Received: from mail.ietf.org ([12.22.58.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id h7txANDCRNc4; Fri, 17 May 2013 11:52:37 -0700 (PDT)
Received: from exprod7og120.obsmtp.com (exprod7og120.obsmtp.com [64.18.2.18]) by ietfa.amsl.com (Postfix) with ESMTP id D1A5F21F9733; Fri, 17 May 2013 11:52:36 -0700 (PDT)
Received: from shell-too.nominum.com ([64.89.228.229]) (using TLSv1) by exprod7ob120.postini.com ([64.18.6.12]) with SMTP ID DSNKUZZ8dFPY0M24wCzaBU5pDJaxBq4cZTvC@postini.com; Fri, 17 May 2013 11:52:36 PDT
Received: from archivist.nominum.com (archivist.nominum.com [64.89.228.108]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "*.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by shell-too.nominum.com (Postfix) with ESMTP id 6FB2C1B80D7; Fri, 17 May 2013 11:52:36 -0700 (PDT)
Received: from webmail.nominum.com (cas-01.win.nominum.com [64.89.228.131]) (using TLSv1 with cipher AES128-SHA (128/128 bits)) (Client CN "mail.nominum.com", Issuer "Go Daddy Secure Certification Authority" (verified OK)) by archivist.nominum.com (Postfix) with ESMTPS id 6949219005D; Fri, 17 May 2013 11:52:36 -0700 (PDT) (envelope-from Ted.Lemon@nominum.com)
Received: from MBX-01.WIN.NOMINUM.COM ([64.89.228.133]) by CAS-01.WIN.NOMINUM.COM ([64.89.228.131]) with mapi id 14.02.0318.004; Fri, 17 May 2013 11:52:36 -0700
From: Ted Lemon <Ted.Lemon@nominum.com>
To: Tero Kivinen <kivinen@iki.fi>
Thread-Topic: Secdir review of draft-ietf-dhc-dhcpv6-radius-opt-11
Thread-Index: AQHOUnyJ4Cz0UNrel0+NQBGO7xYtrZkKJgeAgAAIMICAAAGMgA==
Date: Fri, 17 May 2013 18:52:36 +0000
Message-ID: <8D23D4052ABE7A4490E77B1A012B6307751A4A75@mbx-01.win.nominum.com>
References: <20885.20435.315856.407689@fireball.kivinen.iki.fi> <51967458.22d9440a.44f5.7843@mx.google.com> <20886.31527.670959.767940@fireball.kivinen.iki.fi>
In-Reply-To: <20886.31527.670959.767940@fireball.kivinen.iki.fi>
Accept-Language: en-US
Content-Language: en-US
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
x-originating-ip: [192.168.1.10]
Content-Type: text/plain; charset="Windows-1252"
Content-ID: <C968AC7213E75E47B6254ED4915FBC7A@nominum.com>
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Cc: "<draft-ietf-dhc-dhcpv6-radius-opt.all@tools.ietf.org>" <draft-ietf-dhc-dhcpv6-radius-opt.all@tools.ietf.org>, Tomek Mrugalski <tomasz.mrugalski@gmail.com>, Leaf Yeh <leaf.yeh.sdo@gmail.com>, "<iesg@ietf.org>" <iesg@ietf.org>, "<secdir@ietf.org>" <secdir@ietf.org>
Subject: Re: [secdir] Secdir review of draft-ietf-dhc-dhcpv6-radius-opt-11
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/secdir>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 17 May 2013 18:52:45 -0000

On May 17, 2013, at 2:47 PM, Tero Kivinen <kivinen@iki.fi> wrote:
> That addition text seems to be just what I was looking for. Perfect,
> but better still spell out the VAS, as it is not currently used in
> draft.

That makes sense.

> BTW, while reading the section 4.1. I noticed following text:
> 
>     New RADIUS attributes
>   MAY be added to this list after the IETF Expert Review [RFC5226].
> 
> I do not think MAY is suitable there. The IANA allocation rules either
> are or are not, there is no MAY in there...

That's correct—this will get you a DISCUSS from Pete, so it's best to avoid it.  :)

> Also this same text is also in the section 9, so it might be enough to
> remove it from here, and fix the section 9 to say:
> 
>  The allocation policy of this 'RADIUS attributes permitted in DHCPv6
>  RADIUS option' registry is Expert Review [RFC5226].
> 
> (Note, that Expert might not really be IETF Expert, it might also be
> just for example RADIUS Expert in this case).

That's a good point—we need to decide what sort of expert we want here.   The draft should give some guidance about that.