[secdir] Secdir telechat review of draft-ietf-spring-srv6-network-programming-19
Brian Weis via Datatracker <email@example.com> Tue, 22 September 2020 17:56 UTC
Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 90AE93A18B7; Tue, 22 Sep 2020 10:56:35 -0700 (PDT)
Content-Type: text/plain; charset="utf-8"
From: Brian Weis via Datatracker <firstname.lastname@example.org>
Cc: email@example.com, firstname.lastname@example.org, email@example.com
Reply-To: Brian Weis <firstname.lastname@example.org>
Date: Tue, 22 Sep 2020 10:56:35 -0700
Subject: [secdir] Secdir telechat review of draft-ietf-spring-srv6-network-programming-19
List-Id: Security Area Directorate <secdir.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/secdir>, <mailto:email@example.com?subject=unsubscribe>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/secdir>, <mailto:firstname.lastname@example.org?subject=subscribe>
X-List-Received-Date: Tue, 22 Sep 2020 17:56:36 -0000
Reviewer: Brian Weis Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This is a re-review; thanks to the authors for addressing suggestions made in the first review. The new security considerations text is good, and logically correct so I've marked this document as "Ready". But let me explain one way I think that it could be improved. The last email exchange was about suggesting that the HMAC TLV be used even when an SRH is not included in the packet. The newest text "regardless of the number of segments in the segment list" implies this case, but there is still a concern is that implementors won't get this hint about the possible need to protect just one segment where the SRH is omitted because it's not needed. It would be nice if this sentence could be more explicit about the need for an HMAC TLV in this case. For example, something like: <old> "regardless of the number of segments in the segment list." </old> <new> "regardless of whether the segments are defined in an SRH header or a single segment is passed in the Destination Address." </new> Thanks.
- [secdir] Secdir telechat review of draft-ietf-spr… Brian Weis via Datatracker