Subject: [6lo] Roman Danyliw's Discuss on draft-ietf-6lo-plc-06: (with DISCUSS and COMMENT)

From: Roman Danyliw via Datatracker <[email-masked]>
Date: Mon, 09 Aug 2021 15:21:20 -0700

Roman Danyliw has entered the following ballot position for
draft-ietf-6lo-plc-06: Discuss

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-6lo-plc/

----------------------------------------------------------------------
DISCUSS:
----------------------------------------------------------------------

** Section 8. A few additional threats should be mentioned.  Note that a robust
treatment is not needed here (and likely not possible due to the generality of
this document).  However, they should be acknowledged.

-- This section mentions both availability (DoS) and confidentiality
(eavesdropping) concerns.  Thank you. Wouldn’t there also be the possibility of
significant integrity risks given that possible actuators or sensors being
controlled?   Note if the referenced link layer security mechanisms would be
useful.

-- Figures 5 – 7 seems to present architectures which connects operational
technology to the Internet via the PANC.  However, this section doesn’t
acknowledgement of that risk outright or by citation.

** Section 8.  Per “Thus link layer security mechanisms are designed in the PLC
technologies mentioned in this document”, which specific mechanisms were being
cited is not clear.  Is their use required or are they use case dependent?

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank you to Robert Sparks for the SECDIR review.

** Section 6.  Per “The onboard status of the devices and the topology of the
PLC network can be  visualized via the gateway”, this is the first the
architectural element of a “gateway” is mentioned.  What does it mean to
“visualize via the gateway”?

** Section 6.  Per “The recently-formed iotops WG in IETF is aming to design
more features for the management of IOT networks”, I don’t follow the intent of
this sentence as IOTOPS is not chartered for new protocol work (only
requirements and operational practices).

** Editorial nits

-- Section 1.  Typo. s/efficent/efficient/

-- Section 4.4.  Typo. s/Solicitaitons/ Solicitations/

-- Section 4.5. s/elided.The/elided. The/

-- Section 4.6.  Typo. s/octects/octets/

-- Section 4.6. Typo. s/constranied/constrained/

-- Section 4.6.  Typo. s/fragements/fragments/

-- Section 6.  s/aming/aiming/