Re: [secdir] sec-dir review of draft-ietf-roll-building-routing-reqs-07

[Adrian Farrel <[e-mail]>]

Hi Derek,

I very much appreciate your review.

It is important to understand that this document specifies requirements that 
must/should/etc be satisfied by a protocol designed by the working group. 
Thus, there is no question of what should be deployed or what should be 
implemented.

That is, the document specifies what must be in the protocol spec. We can 
expect the protocol spec to discuss what must be implemented. And either the 
protocol spec or an applicability statement would describe what must be 
deployed.

So, the concerns you raise would be very important in the final protocol 
spec (and I hope the chairs and authors are paying attention), but do not 
seem to me to fit in this document.

Thanks,
Adrian

>> The Security Considerations appear to take into account various
>> requirements for different systems.  What seems to be lacking is
>> direction about how or when to apply various requirements and what
>> it means to the deployment.
>>
>> For example, what would it mean to a deployment if it has
>> authentication versus not having authentication?  Also, it's unclear
>> how these requirements would apply to an implementor.
>>
>> Variable security policies is a good idea, but it requires more
>> guidance because the end user will never understand the ramifications
>> of choosing one policy over another.