Subject: [secdir] Secdir telechat review of draft-ietf-core-resource-directory-25

From: Valery Smyslov via Datatracker <[email-masked]>
Date: Sun, 09 Aug 2020 23:47:23 -0700

Reviewer: Valery Smyslov
Review result: Ready

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

The -24 version of this draft was reviewed by Adam Montville. I looked over his
review and I think that the issue he raised about possible  mitigation of DDoS
amplification attacks has been addressed in this version. I personally think
that sentences describing how DNS and NTP are vulnerable to amplification
attacks are redundant in this document, but that's a matter of taste and
doesn't hurt.

It is my impression, that Security Considerations were mostly written having in
mind that (D)TLS is always used, however it is only "SHOULD" in this draft (or
even "MAY" if we look at RFC6690 which Security Considerations this draft
refers to). I think that adding a few words describing which consequences for
security not using (D)TLS would have and in which cases it is allowed will make
the Security Considerations more consistent.

---

From: Benjamin Kaduk <[email-masked]>
Date: Thu, 13 Aug 2020 11:02:42 -0700

Thanks for the reviews, Valery and Adam!

Like Roman, I filed a Discuss ballot with questions about the authorization
model, including whether transport security such as (D)TLS can/should be
assumed, as you pointed out.  (I also mentioned that the discussion of NTP
DDoS seems out of place...)

-Ben

On Sun, Aug 09, 2020 at 11:47:23PM -0700, Valery Smyslov via Datatracker wrote:
> _______________________________________________
> secdir mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/secdir
> wiki: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview