Subject: Re: [secdir] Secdir telechat review of draft-ietf-core-resource-directory-25

From: Roman Danyliw <[email-masked]>
Date: Thu, 13 Aug 2020 12:47:31 +0000

Hi Valery, thank you for the review!  

I had a few concerns with the authorization model so I entered a Discuss ballot.

Regards,
Roman

> -----Original Message-----
> From: Valery Smyslov via Datatracker <[email-masked]>
> Sent: Mon, 10 August 2020 06:47 UTC
> To: [email-masked]
> Subject: [secdir] Secdir telechat review of draft-ietf-core-resource-directory-25
>
> Reviewer: Valery Smyslov
> Review result: Ready
>
> I have reviewed this document as part of the security directorate's ongoing
> effort to review all IETF documents being processed by the IESG.  These
> comments were written primarily for the benefit of the security area directors.
> Document editors and WG chairs should treat these comments just like any other
> last call comments.

> The -24 version of this draft was reviewed by Adam Montville. I looked over his
> review and I think that the issue he raised about possible  mitigation of DDoS
> amplification attacks has been addressed in this version. I personally think
> that sentences describing how DNS and NTP are vulnerable to amplification
> attacks are redundant in this document, but that's a matter of taste and
> doesn't hurt.

> It is my impression, that Security Considerations were mostly written having in
> mind that (D)TLS is always used, however it is only "SHOULD" in this draft (or
> even "MAY" if we look at RFC6690 which Security Considerations this draft
> refers to). I think that adding a few words describing which consequences for
> security not using (D)TLS would have and in which cases it is allowed will make
> the Security Considerations more consistent.