Re: [secdir] SecDir review of draft-ietf-pce-pcep-service-aware-12

Dhruv Dhody <> Sun, 11 September 2016 17:48 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id A7EC612B0B7; Sun, 11 Sep 2016 10:48:38 -0700 (PDT)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -2.699
X-Spam-Status: No, score=-2.699 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-0.7, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id EPg-LJB1lPiE; Sun, 11 Sep 2016 10:48:37 -0700 (PDT)
Received: from ( [IPv6:2607:f8b0:4003:c06::233]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 1C46812B09A; Sun, 11 Sep 2016 10:48:36 -0700 (PDT)
Received: by with SMTP id m11so261604635oif.1; Sun, 11 Sep 2016 10:48:36 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=mime-version:sender:in-reply-to:references:from:date:message-id :subject:to:cc; bh=BLPFONIpXFg9j7du5W+2T2f+ck/RMz7mHil/+MaDwZg=; b=vkkOiEEbV2V6q0tT9WbjUr+bNWUGHLm80z2G51IMx231z5JccUYXKggPk9X5hy6dbA 0G2CAaSgh0qOAMUQYALkTskdiRzpMQWpRtxVu7PfsAEpHtUuhnnmLO5ggfRmHPV9iquv LSYdkk0EQLHRkOJdM7UtNTreP8gUS4ttKJCZ8KGiLvFUX3naakwsGcsCroxCANoDELVl GL3bngTZYfeIPg1q8UR8O9wynnJ43lpfd/Z8ptfglQGSdT3EdpVBtJ7rhPHgItGGo8m8 JgNUFM2RpNQAimurMcuYSR4tGqt3bgWw00fvPKjfcszf6YrXraoeTGEObxsAtroZ005w Htng==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:mime-version:sender:in-reply-to:references:from :date:message-id:subject:to:cc; bh=BLPFONIpXFg9j7du5W+2T2f+ck/RMz7mHil/+MaDwZg=; b=Zgow4spYOx1Fm+HEQKtU9pvVPXPBKpADl0GuBth6ZdOD95Bg6CSofEjlOu/N9WwA6o c74W7heEz88lWBSIXAsEVjbs657i5Sp610KVzcnBO1TuvOmpxyEFxfBOUsg3YZA2f6Bk i5pyGOhAr0gj5Q1Mu9SW+owYwT8CYi/taHlwIsA4U23DnrXkGtjIUGJEI/PwrOhetj2F o7jDMst/vBDIfCtRR6R/8QkWKkEZhrNXOJdMrw//Ed2SWrmn8Xk2bOkFam7qx4SXVGAf zSEsRJlQYvuc/f0uV8FczONLjMwz4Nf71LDtoNgbPwT+lsphsQg+QkMV+xEIIRM15I0d aqyQ==
X-Gm-Message-State: AE9vXwPj2WfMIssh7ntGiMCOywo0vA66NEk9eOm0K+grJ9l5NN5IaABWChGl/il+udw9rHcptbzyBN13hPw2sA==
X-Received: by with SMTP id h9mr21530551oia.19.1473616116321; Sun, 11 Sep 2016 10:48:36 -0700 (PDT)
MIME-Version: 1.0
Received: by with HTTP; Sun, 11 Sep 2016 10:48:35 -0700 (PDT)
In-Reply-To: <079401d209fd$a2e86200$e8b92600$>
References: <079401d209fd$a2e86200$e8b92600$>
From: Dhruv Dhody <>
Date: Sun, 11 Sep 2016 23:18:35 +0530
X-Google-Sender-Auth: fE3zipgLyB-Z3JF_rlt73AG88yI
Message-ID: <>
To: Christian Huitema <>
Content-Type: multipart/alternative; boundary="001a113cd1ee26172f053c3efd24"
Archived-At: <>
Cc:, The IESG <>,
Subject: Re: [secdir] SecDir review of draft-ietf-pce-pcep-service-aware-12
X-Mailman-Version: 2.1.17
Precedence: list
List-Id: Security Area Directorate <>
List-Unsubscribe: <>, <>
List-Archive: <>
List-Post: <>
List-Help: <>
List-Subscribe: <>, <>
X-List-Received-Date: Sun, 11 Sep 2016 17:48:39 -0000

Hi Christian,

Thanks for your review. I concur with your message. I intend to make no
change based on the sec dir review.


On Thu, Sep 8, 2016 at 11:50 PM, Christian Huitema <>

> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
> This draft is ready.
> The draft (draft-ietf-pce-pcep-service-aware-12), as the title indicates,
> describes "Extensions to the Path Computation Element Communication
> Protocol (PCEP) to compute service aware Label Switched Path (LSP)."
> The extensions include to the path metric object and to the bandwidth
> Utilization The enable computation of latency, delay variation, packet loss
> and bandwidth utilization constraints for a path, and the selection of
> paths accordingly. The draft defines code points for various types of
> computations, as well as new error types.
> The security section states that these extensions do "not add any new
> security concerns beyond those discussed in [RFC5440] and [RFC5541]
> in itself." That's a true statement. This draft does not change the problem
> much, except for the addition of more and more potentially sensitive data
> in the routing messages. We could have a long and heated
> discussion on the appropriateness of the mitigations described in the
> security sections of these [RFC5440] and [RFC5541], such as TCP MD5,
> an optional use of IPSEC and IKE, and some forms of access control. In
> fact,
> we could have that discussion for most routing related drafts. I am not
> suggesting that we have this discussion right now.
> -- Christian Huitema