Re: [secdir] Secdir last call review of draft-ietf-6lo-use-cases-12

Dear Robert Sparks.

Regarding the 6lo use cases draft, thanks for your valuable comments.

We updated the 6lo use cases draft to resolve your comment of Security
Considerations.
https://www.ietf.org/archive/id/draft-ietf-6lo-use-cases-14.html#name-security-considerations-8

It is appreciated to review the updated Security Consideration section.

Best regards

Yong-Geun.

2022년 7월 13일 (수) 오전 12:01, Robert Sparks <rjsparks@nostrum.com>님이 작성:

>
> On 7/11/22 8:16 PM, Yong-Geun Hong wrote:
>
>
> Dear Robert Sparks.
>
> First, thanks for your valuable review and comments of the 6lo use cases
> draft.
> Second, sorry for the late reply. I have acknowledged your email but due
> to other business, I lost the chance to reply immediately.
>
> During the update of this draft, I tried to resolve your comments in the
> revision.
> The following are my responses for your comments.
>
> 1. Update the section of Security Considerations
>    As you mentioned, it seems that the use cases draft does not have
> close relation with security issues but it has several parts which are
> related to security issues in the main body.
>    As you recommend, I added the summary texts in the section of Security
> Considerations.
>
> I don't think the addition is sufficient. As written it's almost cryptic.
> This section should say _why_ L2 security is required, and what the threats
> are if it is not provided.
>
>
> 2. Handling of Appendix A
>    In old versions of this draft, the content in Appendix A is located in
> the main body. During progressing this draft and resolving the comments, it
> was moved to Appendix A.
>    At the IETF 114, I would ask for directions and decide how to proceed.
>
>
> 3. Misuse of technology description and marketing words
>   As you pointed, the draft has some parts which are recognized as
> marketing words. Because we invited some experts who are involved in the
> specific area, some marketing words could be included.
>  I tried to change the marketing words to technology words in the revision.
>
> You could find the revised version of this draft in here :
> https://datatracker.ietf.org/doc/draft-ietf-6lo-use-cases
>
> Once again, thanks for your review and comments
>
> Best regards.
>
> Yong-Geun.
>
> 2022년 4월 6일 (수) 오전 6:09, Robert Sparks <rjsparks@nostrum.com>님이 작성:
>
>> Apologies, there's an edit-buffer glitch below, corrected in what's
>> uploaded at
>>
>> https://datatracker.ietf.org/doc/review-ietf-6lo-use-cases-12-secdir-lc-sparks-2022-04-05/
>> .
>>
>> On 4/5/22 4:04 PM, Robert Sparks via Datatracker wrote:
>> > Reviewer: Robert Sparks
>> > Review result: Has Issues
>> >
>> > I have reviewed this document as part of the security directorate's
>> ongoing
>> > effort to review all IETF documents being processed by the IESG. These
>> comments
>> > were written primarily for the benefit of the security area directors.
>> Document
>> > editors and WG chairs should treat these comments just like any other
>> last call
>> > comments.
>> >
>> > This document has issues to address before publication as an
>> Informational RFC
>> >
>> > Issues:
>> >
>> > >From the abstract: "The document targets an audience who would like to
>> > understand and evaluate running end-to-end IPv6 over the constrained
>> node
>> > networks for local or Internet connectivity."
>> >
>> > Its security considerations section claims "Security considerations are
>> not
>> > directly applicable to this document". Yet the text of the draft has
>> several
>> > places that rightly call out thing like "there exist implications for
>> privacy",
>> > "privacy also becomes a serious issue", and "the assumption is that L2
>> security
>> > must be present." A summary of these things in the security
>> considerations
>> > section seems prudent. At _least_ call out again the assumption about L2
>> > security.
>> >
>> > The "Security Requirement"A summary of these things in the security
>> > considerations section seems prudent. At _least_ call out again the
>> assumption
>> > about L2 security.
>> >
>> > The "Security Requirement" row in Table 2 is not well explained. The
>> values in
>> > that row are explained at all. (For instance, the word "Partially"
>> appears
>> > exactly once in the document - it is unclear what it means).
>> >
>> > Nits/Comments:
>> >
>> > Appendix A is neither introduced nor referenced from the body of the
>> document.
>> > Why is it here?
>> >
>> > I'm a little concerned about some of the technology descriptions
>> possibly
>> > moving beyond simple facts into interpretation or even marketing. The
>> last
>> > paragraph of section 2.5 is a particularly strong example. Look for
>> phrases
>> > section 4 that include "targets" or "targeted by" and make sure that's
>> what the
>> > organizations ins that define those technologies say (consider
>> references).
>> >
>> > At 'superior "range"', why is range in quotes? Think about
>> restructuring the
>> > sentences that use 'superior' to avoid the connotation of "better
>> than". All
>> > this document really needs to acknowledge is "goes further".
>> >
>> >
>> >
>> > _______________________________________________
>> > secdir mailing list
>> > secdir@ietf.org
>> > https://www.ietf.org/mailman/listinfo/secdir
>> > wiki: https://trac.ietf.org/trac/sec/wiki/SecDirReview
>>
>