Re: [secdir] Review of draft-ietf-mpls-tp-gach-dcn-06

[Shawn M Emery <[e-mail]>]

Adrian Farrel wrote:
> Thanks for the review, Shawn.
>
>> The security considerations section does exist and describes that DCN 
>> messages are required to have adequate security mechanisms.  The 
>> section doesn't describe what those mechanisms are, but should at 
>> least provide a reference from other MPLS RFC/I-Ds that do.
>
> I'm a little unclear what you are asking for here.
> The draft defines a channel (i.e. a logical data link) down which any 
> packet-based protocol could be run.
> Are you suggesting that this draft should contain a reference to the 
> security mechanisms for each protocol that might be run down the 
> channel? That seems like an impossible task.
>
> We could, I suppose, add text to note that "the MPLS data plane does 
> not include any security mechanisms of its own, therefore it is 
> important that protocols using the DCN apply their own security."

Yes or a reference to something like RFC 3985's security considerations 
section, as it also does a good job in explaining the inherit risks of 
existing packet protocols and possible solutions.

Regards,

-- 
Shawn.