Re: [secdir] sec-dir review of draft-ietf-roll-building-routing-reqs-05.txt

[Adrian Farrel <[e-mail]>]

Derek,

I appreciate the review and hope that it will be useful to the authors.

Since a new revision is expected, maybe the authors will be able to work 
with this.

Cheers,
Adrian
----- Original Message ----- 
From: "Derek Atkins" <[e-mail]>
To: <[e-mail]>; <[e-mail]>
Cc: <[e-mail]>; <[e-mail]>; 
<[e-mail]>; <[e-mail]>; 
<[e-mail]>
Sent: Wednesday, May 20, 2009 9:47 PM
Subject: sec-dir review of draft-ietf-roll-building-routing-reqs-05.txt


>I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the
> IESG.  These comments were written primarily for the benefit of the
> security area directors.  Document editors and WG chairs should treat
> these comments just like any other last call comments.
>
>   The Routing Over Low power and Lossy network (ROLL) Working Group has
>   been chartered to work on routing solutions for Low Power and Lossy
>   networks (LLN) in various markets: Industrial, Commercial (Building),
>   Home and Urban. Pursuant to this effort, this document defines the
>   routing requirements for building automation.
>
> The Security Considerations appear to take into account various
> requirements for different systems.  What seems to be lacking is
> direction about how or when to apply various requirements and what
> it means to the deployment.
>
> For example, what would it mean to a deployment if it has
> authentication versus not having authentication?  Also, it's unclear
> how these requirements would apply to an implementor.
>
> Variable security policies is a good idea, but it requires more
> guidance because the end user will never understand the ramifications
> of choosing one policy over another.
>
> -derek
>
> -- 
>       Derek Atkins                 617-623-3745
>       [e-mail]             www.ihtfp.com
>       Computer and Internet Security Consultant
>