Re: [secdir] secdir review of draft-ietf-opsawg-coman-use-cases-03

[joel jaeggli <[e-mail]>]

Thanks Matt!

joel

On 1/13/15 12:49 PM, ⌘ Matt Miller wrote:
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
>  These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
> SUMMARY:
> 
> This Informational document describes use cases for managing a network
> involving constrained devices (e.g., sensors, smart controllers), along
> with a discussion on network access and the operational lifecycle of
> such devices.  This also covers some situational guidelines and
> requirements specific to the discussed use cases.
> 
> This document is ready with nits.  My one issue I have might not be
> appropriate for this use case document, and my other nits are simply
> editorial.
> 
> 
> MINOR ISSUE:
> 
> There is little mention about data protection within this document, but
> is discussed some in [COM-REQ].  However, neither this document nor
> [COM-REQ] include any discussion about protecting data as it traverses
> networks (e.g., using TLS or DTLS), as far as I can tell.  I assume this
> will be covered in greater detail in any Standards Track documents
> derived from these documents, but might be worthwhile to at least
> mention in the use cases where in-transit data protection needs special
> considerations, if not more generally in [COM-REQ].
> 
> 
> NITS (not security related):
> 
> * RFC7228 is listed as informational, but it probably ought to be
> normative.  It seems to me that it's necessary to understand the terms
> from RFC7228 in order to understand this document.
> 
> * [COM-REQ] is listed as an informational reference, but ought to be
> normative.  It seems to me that it's necessary to understand [COM-REQ]
> in order to understand this document, at least from a security perspective.
> 
> * Throughout the document, the locution "ad-hoc" should be "ad hoc".
> 
> * Throughout the document, the phrase "In cases" is almost always (two
> out of three) followed by a comma, which seems superfluous.
> 
> * In section 1. second paragraph, "type" should be "types" in the phrase
> "... the management of a network with constrained devices offers
> different type of challenges compared to ...".
> 
> * In section 2. last paragraph, "since tend" should be "since they tend"
> in the phrase "... are not discussed here since tend to be quite static
> and do not typically impose ..."
> 
> * In section 4.1. second paragraph, "looses" should be "loses" in the
> phrase "... new constrained devices in case the system looses too much
> of its structure."
> 
> * In section 4.1. second paragraph, "loosing" should be "losing" in the
> phrase "... deal with events such as loosing neighbors or being moved to
> other locations."
> 
>