[secdir] Re: Secdir last call review of draft-ietf-6man-vpn-dest-opt-01

[Erik Kline <[e-mail]>]

Peter,

Thank you for the review.

Ron,

Hopefully there is enough time between now at the 2025.04.17 telechat
date to produce a -02 with relevant changes.

-Erik


On Sat, Feb 8, 2025 at 9:45 PM Peter Yee via Datatracker <[e-mail]>
wrote:

> Reviewer: Peter Yee
> Review result: Has Nits
>
> Reviewer: Peter Yee
> Review result: Has Nits
>
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG. These
> comments
> were written primarily for the benefit of the security area directors.
> Document
> editors and WG chairs should treat these comments just like any other last
> call
> comments.
>
> Summary: This document defines an experimental IPv6 Destination Option for
> use
> with non-MPLS VPNs. While this option specification doesn’t give a whole
> lot of
> detail on the operational use of the option, it does give security
> considerations that seem reasonable if not highly specified.
>
> The summary of the review is Has Nits.
>
> Major issues: None
>
> Minor issues:
>
> Page 3, last paragraph, 2nd sentence: I’m not entirely sure what is meant
> by
> this sentence. Is it trying to say, “Another purpose is to demonstrate
> that the
> security considerations are sufficient to protect use of the VPN Service
> Option”? I’m not sure how either that objective or my reading of the one
> in the
> document is demonstrated. Security considerations are something that stand
> a
> test of time, but I’m not sure one can ever be fully certain that they are
> sufficient.
>
> Page 4, section 3, 3rd bullet item, 2nd sub-bullet item: does anything more
> need to be said about these 20 bits are used to identify and differentiate
> interfaces from each other or is that not germane to the experiment?
>
> Page 8, 2nd paragraph, 4th sentence: Is 2^12 really highly unlikely? In
> cryptographic algorithm contexts, it likely wouldn’t be. I have no basis to
> judge whether two experiments running simultaneously might collide, so I’m
> just
> raising the question.
>
> Nits:
>
> Page 4, section 3, 3rd bullet item: change “32-bits” to “32 bits”.
>
> Page 4, section 3, 3rd bullet item, 1st sub-bullet: change “12 bit” to
> “12-bit”.
>
> Page 4, section 3, 1st paragraph after the bullet list, 3rd sentence:
> delete
> the duplicated “appears in”.
>
> Page 4, section 3, 2nd paragraph after the bullet list: delete the space
> between “NOTE” and “:”.
>
> Page 5, section 4, 1st paragraph, 1st sentence: insert “the” before
> “customer”.
>
> Page 7, section 7, 2nd bullet list, 1st bullet item: change “option” to
> “Option”.
>
> Page 7, section 7, 1st paragraph after 2nd bullet list, 2nd sentence:
> change
> “fo” to “of”.
>
> Page 7, section 7, 2nd paragraph after 2nd bullet list, 1st sentence:
> consider
> inserting “capable of” before the first occurrence of “modifying”.
>
> Page 8, 1st paragraph, 2nd sentence: change “imediment” to “impediment”.
> Change
> “deplyment” to “deployment”.
>
> Page 8, section 9, 5th bullet item, 1st sub-bullet item: change
> “inter-operable” to “interoperable”. If you can use “interoperability” in
> the
> following sentence, I don’t see why the adjective needs to be hyphenated
> in the
> first.
>
>
>