Subject: Re: [Gen-art] Gen-ART review of draft-ietf-opsec-bgp-security-05

From: Jari Arkko <[email-masked]>
Date: Wed, 15 Oct 2014 15:09:49 -0700

Thanks for the review, Christer!

On 18 Sep 2014, at 22:40, Christer Holmberg <[email-masked]> wrote:

> Hi Jerome,
> 
>>> Q_4_2: The last sentence says "For a more detailed recommendation, see RFC6192 [18].". Recommendation on what?
>> 
>> Recommendation of router protection (section title) I propose we clarify that in the text:
>> 
>> "For a more detailed recommendation on how to protect the router's control plane, see RFC6192 [18] >
> 
> Looks good.
> 
>>> Section 5:
>>> 
>>>       	Q_5_1: The name of section 5 uses "BGP sessions", but the section text does not say anything about BGP sessions. And, in section 5.1 you only 
>>> 	talk about "TCP sessions used by BGP". Only in section 5.2 do you mention "BGP session". Perhaps you should add some general text to section 5 
>>> 	about BGP sessions, how TCP is used to transport BGP messages in BGP sessions etc, and then in section 5.1 only talk about protection of TCP.
>> 
>> OK, I'll see how to clearly add session key word in first paragraph of 5.
> 
> Thanks! This was the main editorial issue I had with the document, so hopefully you'll find a way to make it more clear :)
> 
> Thanks!
> 
> Regards,
> 
> Christer
> 
> _______________________________________________
> Gen-art mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/gen-art

---

From: Christer Holmberg <[email-masked]>
Date: Sun, 19 Oct 2014 15:08:07 +0000

I am the assigned Gen-ART reviewer for this draft. For background on Gen-ART, please see the FAQ at <http://wiki.tools.ietf.org/area/gen/trac/wiki/GenArtfaq>

Document:                         draft-ietf-weirds-rdap-sec-09

Reviewer:                           Christer Holmberg

Review Date:                     19 October 2014

IETF LC End Date:             24 October 2014

IETF Telechat Date:         30 October 2014

Summary:                         I have found a number of issues. They are of editorial nature, but makes it difficult to understand the mechanism. I ask the authors to look at those, and consider if/how they can be addressed.

Major Issues: None

Minor Issues: None

Q1_GENERAL:

In the Introduction, you say that one of the goal of RDAP is to provide security services, that do not exist in WHOIS.

However, in section 3 you then say that RDAP doesn't provide any of these security services, but relies on other protocols.

First, I think you need to re-formulate the text in the Introduction, and talk about how other protocols can be used to provide security services for RDAP.

Second, there is no text on why "other protocols" couldn't be used to provide security services for WHOIS. I think you need to

say that, if you want to claim that RDAP provides better security than WHOIS.

Q2_GENERAL:

              In some places you say that additional/alternative mechanisms may be defined in the future. I think it would be good to in

the Introduction indicate that additional/alternative mechanisms can be added in the future.

Q3_GENERAL:

              You start some subsections by describing what WHOIS does/doesn't do. I think you should first describe of

the specific security service is provided for RDAP, and then later describe e.g. why the same cannot be provided

for WHOIS

Q4_3_1_1:

              Section 3.1.1. says: "Federated authentication mechanisms used by RDAP are OPTIONAL."

              That statement is confusing. Does it mean that everything else in the document is mandatory to support?

Q5_3_3:

              The name of section 3.3 is "Availability". I don't see how that is a security service, and the text mostly talks about

throttling. Would it be more appropriate to say "Request throttling" instead?

Q6_3_4:

              Section 3.4 says:

              "Web services such as RDAP commonly use HTTP Over TLS [RFC2818] to provide that protection by encrypting all

              traffic sent on the connection between client and server."

              To me that sounds like something from a BCP document. I think you should say that the document defines

the usage of HTTP over TLS for providing the security service.

Editorial nits: None

Regards,

Christer