[secdir] Secdir early review of draft-ietf-idr-bgp-ct-30

Magnus Nyström via Datatracker <noreply@ietf.org> Mon, 08 April 2024 05:17 UTC

Return-Path: <noreply@ietf.org>
X-Original-To: secdir@ietf.org
Delivered-To: secdir@ietfa.amsl.com
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 5FE78C14F70E; Sun, 7 Apr 2024 22:17:16 -0700 (PDT)
MIME-Version: 1.0
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
From: Magnus Nyström via Datatracker <noreply@ietf.org>
To: secdir@ietf.org
Cc: draft-ietf-idr-bgp-ct.all@ietf.org, idr@ietf.org
X-Test-IDTracker: no
X-IETF-IDTracker: 12.9.0
Auto-Submitted: auto-generated
Precedence: bulk
Message-ID: <171255343637.3005.42205344596392120@ietfa.amsl.com>
Reply-To: Magnus Nyström <magnusn@gmail.com>
Date: Sun, 07 Apr 2024 22:17:16 -0700
Archived-At: <https://mailarchive.ietf.org/arch/msg/secdir/alzGCJYNS16NyBsp6wyDhQi-QWY>
Subject: [secdir] Secdir early review of draft-ietf-idr-bgp-ct-30
X-BeenThere: secdir@ietf.org
X-Mailman-Version: 2.1.39
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:secdir-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/secdir/>
List-Post: <mailto:secdir@ietf.org>
List-Help: <mailto:secdir-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:secdir-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 08 Apr 2024 05:17:16 -0000

Reviewer: Magnus Nyström
Review result: Has Nits

Comparing with my original review (-18) the authors have addressed my concerns.
There is one remaining, probably smaller, issue: The Security Considerations
section states: "In order to mitigate the risk of the diversion of traffic from
its intended destination, existing BGPsec solution could be extended and
supported for this SAFI." - was this meant to say "existing BGPsec solutions"
or "the existing BGP solution"? Also, it isn't clear how BGPsec should be
extended - and if it would provide any substantial benefit over the mechanisms
described herein (the remainder of this paragraph states: "The restriction of
the aplicability of this SAFI to its intended well-defined scope limits the
likelihood of traffic diversions. Furthermore, as long as the filtering and
appropriate configuration mechanisms discussed previously are applied
diligently, risk of the diversion of the traffic is significantly mitigated.").