Subject: [pcp] Terry Manderson's No Objection on draft-ietf-pcp-authentication-13: (with COMMENT)

From: "Terry Manderson" <[email-masked]>
Date: Tue, 07 Jul 2015 19:57:39 -0700

Terry Manderson has entered the following ballot position for
draft-ietf-pcp-authentication-13: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pcp-authentication/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thanks for addressing an aspect of security in relation to PCP,
especially the Advanced Threat Model from RFC6887.

I have a few comments

1) I'm sure the RFC editor will pick these up, however there is some
comma usage in the document that caused me to re-read some of the
paragraphs to understand. The Abstract is one example of this. I'm
certainly no expert so perhaps have a skim over this:
http://www.grammarbook.com/punctuation/commas.asp

2) s 3.1.1, please consider rewording the text "Section 5.1 updates the
PCP request message format to have a result code." to something like
"Section 5.1 updates the PCP request message format with result codes for
the PCP Authentication mechanism" ...The wording as it stands seems a
little non-specific.

3) Basic DoS attacks (such as state bloat) are mentioned in the security
section, are there any complex DoS attacks that can be leveraged using
the PCP authentication mechanism itself?

---

From: "Tirumaleswar Reddy (tireddy)" <[email-masked]>
Date: Thu, 9 Jul 2015 14:12:12 +0000

> -----Original Message-----
> From: pcp [mailto:[email-masked]] On Behalf Of Terry Manderson
> Sent: Wednesday, July 08, 2015 8:28 AM
> To: The IESG
> Cc: [email-masked]
> Subject: [pcp] Terry Manderson's No Objection on draft-ietf-pcp-
> authentication-13: (with COMMENT)
> 
> When responding, please keep the subject line intact and reply to all email
> addresses included in the To and CC lines. (Feel free to cut this introductory
> paragraph, however.)
> 
> 
> Thanks for addressing an aspect of security in relation to PCP, especially the
> Advanced Threat Model from RFC6887.
> 
> I have a few comments
> 
> 1) I'm sure the RFC editor will pick these up, however there is some comma
> usage in the document that caused me to re-read some of the paragraphs to
> understand. The Abstract is one example of this. I'm certainly no expert so
> perhaps have a skim over this:
> 2) s 3.1.1, please consider rewording the text "Section 5.1 updates the PCP
> request message format to have a result code." to something like "Section 5.1
> updates the PCP request message format with result codes for the PCP
> Authentication mechanism" ...The wording as it stands seems a little non-
> specific.

Thanks, fixed in my local copy.

> 
> 3) Basic DoS attacks (such as state bloat) are mentioned in the security section,
> are there any complex DoS attacks that can be leveraged using the PCP
> authentication mechanism itself ?

I don't think so. Attack on PCP authentication depends on the EAP method used, for example if TEAP is used various possible DoS attacks and mitigations are discussed in TEAP protocol https://tools.ietf.org/html/rfc7170.

-Tiru

> 
> 
> _______________________________________________
> pcp mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/pcp

---

From: Terry Manderson <[email-masked]>
Date: Thu, 9 Jul 2015 14:16:22 +0000

Hi Tiru,

Thanks for addressing my comments.

Cheers
Terry

On 10/07/2015 12:12 am, "Tirumaleswar Reddy (tireddy)" <[email-masked]>
wrote:

>>email
>> Please refer to 
>>https://www.ietf.org/iesg/statement/discuss-criteria.html
>>comma
>>PCP
>I don't think so. Attack on PCP authentication depends on the EAP method
>used, for example if TEAP is used various possible DoS attacks and
>mitigations are discussed in TEAP protocol
>https://tools.ietf.org/html/rfc7170.
>
>-Tiru
>
>> 
>>