[secdir] SecDir Review of draft-ietf-behave-dccp-03

[Catherine Meadows <[e-mail]>]

  I have reviewed this document as part of the security directorate's  
ongoing effort to review all IETF documents being processed by the  
IESG. These comments were written primarily for the benefit of the  
security area directors.  Document editors and WG chairs should treat  
these comments just like any other last call comments.

This draft gives a set of behavioral requirements for network address  
translation for DCCP.
In the secure considerations section, the authors discuss the  
requirements that have security considerations,
and give recommendations.   This mostly looks in good shape, but I  
have trouble understanding the discussion of
Requirement 5 in this section.  It reads, in its entirety:

  REQ-5 recommends that a NAT that passively monitors DCCP state keep
    idle sessions alive for at least 124 minutes or 4 minutes depending
    on the state of the connection. it may attempt to actively determine
    the liveliness of a DCCP connection or let the NAT administrator
    configure more conservative timeouts.


It's unclear what the relationship is to security is here.  The  
discussion needs to make that explicit.

Some minor nits:

"problems. and" in the discussion of REQ-4 should be "problems and"

Second sentence in the discussion of REQ-5 should begin with a capital  
letter.


Catherine Meadows
Naval Research Laboratory
Code 5543
4555 Overlook Ave., S.W.
Washington DC, 20375
phone: [phone]
fax: [phone]
email: [e-mail]



_______________________________________________
secdir mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/secdir