Re: [secdir] secdir review of draft-ietf-pce-pcep-mib-10

["Adrian Farrel" <[e-mail]>]

Sec and Ops ADs...

Could you please interpret this review by Carl in the context of the "best current advice" and boilerplate for MIB modules.

Thanks,
Adrian

> -----Original Message-----
> From: iesg [mailto:[e-mail]] On Behalf Of Carl Wallace
> Sent: 24 October 2014 12:31
> To: [e-mail]
> Cc: [e-mail]; [e-mail]
> Subject: secdir review of draft-ietf-pce-pcep-mib-10
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments
> just like any other last call comments.
> 
> 
> This document describes a MIB that "describes managed objects for modeling
> of Path Computation Element communications Protocol (PCEP) for
> communications between a Path Computation Client (PCC) and a Path
> Computation Element (PCE), or between two PCEs”.
> 
> I am not a MIB guy and did not review the definitions.  The security
> considerations section mostly addresses SNMP related considerations in
> general via references to other specs.  This seems fine.  The only minor
> nit here is the following:
> 
> 	Implementations MUST provide the security features described by the
> SNMPv3 framework (see [RFC3410]), including full support for
> authentication and privacy via the User-based Security Model (USM)
> [RFC3414] with the AES cipher algorithm [RFC3826].
> 
> RFC3410 only defines support for use of CBC-DES.  If support for AES is
> intended instead of DES, that should be noted more strongly here.  The
> requirement for "full support" of RFC3414 could be misinterpreted.