Subject: [manet] Alexey Melnikov's No Objection on draft-ietf-manet-dlep-28: (with COMMENT)

From: Alexey Melnikov <[email-masked]>
Date: Mon, 27 Mar 2017 15:15:59 -0700

Alexey Melnikov has entered the following ballot position for
draft-ietf-manet-dlep-28: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-manet-dlep/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

This is generally a well written document and I enjoyed reading it.

Section 14 (Security Considerations) now says:

   At the transport layer, when TLS is in use, each peer SHOULD check
   the validity of credentials presented by the other peer during TLS
   session establishment.  Implementations following the "dedicated
   deployments" model attempting use of TLS MAY need to consider use of
   pre-shared keys for credentials

I think you need an reference here, such as RFC 5487.

   , and provide specialized techniques
   for peer identity validation.

Section 4 of 7925 has some discussion of credential types for IoT, some
of which might be useful in DLEP. But I am not sure whether this is the
great reference. (If you add it, you probably should make it
Informative.)

   Implementations following the
   "networked deployment" model described in Implementation Scenarios
   SHOULD refer to [RFC7525] for additional details.