[secdir] secdir Review of draft-ietf-ppsp-problem-statement

[Russ Mundy <[e-mail]>]

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments.

The document has more of a "marketing" tone to it than most IETF documents and, as such, seems more like a "why do we need to do this ppsp protocol" (or protocol suite?) than a problem statement.  On the other hand, if the working group believes that publishing this information will help with reaching their goals or providing context to potential future implementers of actual protocol specifications, I don't see any reason not to publish it - as long as it remains Informational.

With respect to the security considerations section, the information seems to be good particularly since the document itself covers a wide range of potential protocol specifications.  Requiring subsequent specifications to address specific threats and mitigations is good but it would also be good for these specifications to document specific security requirements for the protocols as well as the threats.  Additionally, specifically excluding support for a particular requirement (Digital Rights Management (DRM)) does not seem to make sense in this document since it claims to be a problem statement - this sounds much more like the statement of a non-requirement than a security consideration and should be in some requirements document or the requirements section of protocol specifications.

Russ Mundy