[secdir] Re: Secdir last call review of draft-ietf-6man-vpn-dest-opt-01

[Ron Bonica <[e-mail]>]

Thanks for the careful review. I will post a new version in a few minutes




Juniper Business Use Only

________________________________
From: Erik Kline <[e-mail]>
Sent: Sunday, February 9, 2025 5:28 PM
To: Peter Yee <[e-mail]>
Cc: [e-mail] <[e-mail]>; [e-mail] <[e-mail]>; [e-mail] <[e-mail]>
Subject: Re: Secdir last call review of draft-ietf-6man-vpn-dest-opt-01


[External Email. Be cautious of content]


Peter,

Thank you for the review.

Ron,

Hopefully there is enough time between now at the 2025.04.17 telechat date to produce a -02 with relevant changes.

-Erik


On Sat, Feb 8, 2025 at 9:45 PM Peter Yee via Datatracker <[e-mail]<mailto:[e-mail]>> wrote:
Reviewer: Peter Yee
Review result: Has Nits

Reviewer: Peter Yee
Review result: Has Nits

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG. These comments
were written primarily for the benefit of the security area directors. Document
editors and WG chairs should treat these comments just like any other last call
comments.

Summary: This document defines an experimental IPv6 Destination Option for use
with non-MPLS VPNs. While this option specification doesn’t give a whole lot of
detail on the operational use of the option, it does give security
considerations that seem reasonable if not highly specified.

The summary of the review is Has Nits.

Major issues: None

Minor issues:

Page 3, last paragraph, 2nd sentence: I’m not entirely sure what is meant by
this sentence. Is it trying to say, “Another purpose is to demonstrate that the
security considerations are sufficient to protect use of the VPN Service
Option”? I’m not sure how either that objective or my reading of the one in the
document is demonstrated. Security considerations are something that stand a
test of time, but I’m not sure one can ever be fully certain that they are
sufficient.

Page 4, section 3, 3rd bullet item, 2nd sub-bullet item: does anything more
need to be said about these 20 bits are used to identify and differentiate
interfaces from each other or is that not germane to the experiment?

Page 8, 2nd paragraph, 4th sentence: Is 2^12 really highly unlikely? In
cryptographic algorithm contexts, it likely wouldn’t be. I have no basis to
judge whether two experiments running simultaneously might collide, so I’m just
raising the question.

Nits:

Page 4, section 3, 3rd bullet item: change “32-bits” to “32 bits”.

Page 4, section 3, 3rd bullet item, 1st sub-bullet: change “12 bit” to “12-bit”.

Page 4, section 3, 1st paragraph after the bullet list, 3rd sentence: delete
the duplicated “appears in”.

Page 4, section 3, 2nd paragraph after the bullet list: delete the space
between “NOTE” and “:”.

Page 5, section 4, 1st paragraph, 1st sentence: insert “the” before “customer”.

Page 7, section 7, 2nd bullet list, 1st bullet item: change “option” to
“Option”.

Page 7, section 7, 1st paragraph after 2nd bullet list, 2nd sentence: change
“fo” to “of”.

Page 7, section 7, 2nd paragraph after 2nd bullet list, 1st sentence: consider
inserting “capable of” before the first occurrence of “modifying”.

Page 8, 1st paragraph, 2nd sentence: change “imediment” to “impediment”. Change
“deplyment” to “deployment”.

Page 8, section 9, 5th bullet item, 1st sub-bullet item: change
“inter-operable” to “interoperable”. If you can use “interoperability” in the
following sentence, I don’t see why the adjective needs to be hyphenated in the
first.