Re: [secdir] Secdir last call review of draft-ietf-quic-recovery-32

[Lucas Pardue <[e-mail]>]

Hi Derrell,

Thank you for the review. I've opened a GitHub issue for any discussion
related to this review: https://github.com/quicwg/base-drafts/issues/4324

There is also a milestone at
https://github.com/quicwg/base-drafts/milestone/8.

Thanks,
Lucas

On Mon, Nov 2, 2020 at 8:20 PM Derrell Piper via Datatracker <
[e-mail]> wrote:

> Reviewer: Derrell Piper
> Review result: Ready
>
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area
> directors.  Document editors and WG chairs should treat these comments just
> like any other last call comments.
>
> The summary of the review is: Ready, with an optional nit.
>
> This document is QUIC's Loss Detection and Congestion Control and is part
> of
> QUIC Last Call.
>
> Pp. 7, "after the epoch starts is acknowledged" should maybe be singular,
> unless the intent is literal and I'm missing what a "starts" is.
>
> There's no explicit security going on here, other than in the larger
> picture
> of QUIC itself, namely that in QUIC-TLS and QUIC-TRANSPORT; this is only
> its
> congestion control.  However, Security Considerations correctly highlights
> some of the major traffic analysis concerns with QUIC and congestion
> control
> in general, and there are some, but these are not unique to QUIC, nor would
> they likely be addressed inside of congestion control, so this is okay.  It
> seems well written and based on a practical understanding of existing TCP
> congestion control along with current academic research on this topic.
>
> Derrell
>
>
>