Subject: [ippm] Adoption call for IOAM deployment and integrity documents

From: "Joe Clarke (jclarke)" <[email-masked]>
Date: Fri, 13 Aug 2021 16:12:24 +0000

I have read rev 03 of both documents, and I feel these works are worth
adopting.  I do have a comment about the integrity doc.  I'm glad to see
this work come forward as I agree with the previous reviews that
ensuring integrity (arguably by default) is valuable.  What I felt might
be under-stating here is the "general" statement in Section 3.  You
mention that the false illusion could prevent detection of actual
problems or cause false positives that require more processing.

But for POT, I wonder if that's saying enough.  The POT use case, in
particular, while you can say that a general DoS could be the outcome of
IOAM manipulation, I thought saying something to the effect of
circumventing security services in an SFC by "lying" about transit is
more than just preventing spotting actual problems or causing additional
processing.  I think the POT use case could use more fleshing out here
in terms of the threat model.  Though that can certainly happen after
adoption.

Joe