[secdir] secdir review of draft-ietf-pwe3-fc-encap-14.txt

[Stephen Hanna <[e-mail]>]

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the IESG. 
These comments were written primarily for the benefit of the security 
area directors.  Document editors and WG chairs should treat these 
comments just like any other last call comments.

This document describes how Fibre Channel traffic can be carried
over MPLS networks using a Fibre Channel pseudowire (FC PW). I am
not an expert in Fibre Channel, MPLS, or pseudowires so I will not
venture any judgment on the content of the draft. I will focus
exclusively on the Security Considerations section.

The Security Considerations section is rather brief, only five
sentences long. While I support brevity, this section seems to
omit key information. For example, the text says "FC PW shares
susceptibility to a number of pseudowire-layer attacks and
implementations SHOULD use whatever mechanisms for confidentiality,
integrity, and authentication are developed for PWs in general.
These methods are beyond the scope of this document." That's too
brief. At least, the authors should add a reference to a document
that describes the attacks to which this protocol is susceptible
and the countermeasures that can be employed. If no such document
exists, either it should be written or this document should describe
the threats and countermeasures or this document should admit that
the threats and countermeasures are not understood at this time.
You can't just leave the analysis of threats and countermeasures
to the reader.

Thanks,

Steve Hanna