Subject: [secdir] Secdir review of draft-ietf-ippm-owamp-registry-03

From: Alan DeKok <[email-masked]>
Date: Wed, 16 Sep 2015 14:02:33 -0400

I have reviewed this document as part of the security directorate's 
ongoing effort to review all IETF documents being processed by the 
IESG.  These comments were written primarily for the benefit of the 
security area directors.  Document editors and WG chairs should treat 
these comments just like any other last call comments.

  This document requests IANA allocation of registries for OWAMP.   As such, it has minimal security impact.

  One practical note is the request to assign an "Experimentation" OWAMP-Control Command Number.  Experience shows that such numbers are either never used, or used as experiments... which then get widely deployed before standards action catches up to practical needs.

  It may be good to add some discussion as to *how* experiments are done, and how experiments can transition from the "Experimentation" number to a standard number.

  One suggestion would be to change the label from "Experimentation" to "Site-Local".  That would still allow sites to experiment with OWAMP-Control commands, but would make it clearer that such experimentation is only for the local site, and MUST NOT be used in a  wider context.

---

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 17 Sep 2015 10:02:49 -0400

Hi Alan,
thanks for your review, please see replies below.
FWIW - I had to look-up the details.
Al

> -----Original Message-----
> From: Alan DeKok [mailto:[email-masked]]
> Sent: Wednesday, September 16, 2015 2:03 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Secdir review of draft-ietf-ippm-owamp-registry-03
> 
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
>   One practical note is the request to assign an "Experimentation"
> OWAMP-Control Command Number.  Experience shows that such numbers are
> either never used, or used as experiments... which then get widely
> deployed before standards action catches up to practical needs.

[ACM] 
I understand how this might happen, but IETF already has a 
BCP that covers this topic: https://tools.ietf.org/html/bcp82

> 
>   It may be good to add some discussion as to *how* experiments are
> done, and how experiments can transition from the "Experimentation"
> number to a standard number.

[ACM] 
IMO, BCP82 covers this aspect adequately. 

> 
>   One suggestion would be to change the label from "Experimentation" to
> "Site-Local".  That would still allow sites to experiment with OWAMP-
> Control commands, but would make it clearer that such experimentation is
> only for the local site, and MUST NOT be used in a  wider context.

[ACM] 
Site-local is not a valid registry assignment, see:
https://tools.ietf.org/html/rfc5226#section-4
Also, I would expect that an Internet performance characterization
protocol will be deployed on the Internet when using an experimental command
to conduct experiments, so not Site-Local.

Note that the existing reference to RFC5226 makes a clear reference to
BCP 82 in section 4.