Subject: [Pearg] Review of draft-irtf-pearg-numeric-ids-history-01

From: "Christopher Wood" <[email-masked]>
Date: Sat, 28 Mar 2020 17:44:30 -0700

Document: draft-irtf-pearg-numeric-ids-history-01 [https://tools.ietf.org/id/draft-irtf-pearg-numeric-ids-history-01.txt]

Assessment: Almost ready

Thanks for putting this information together! I think the analysis and timeline are 
a testament to the importance and subtleties of numeric identifier generation. 
The amount of detail is quite comprehensive. Even if there are glaring omissions,
I think the overall point is made clear.

I only have some high level comments on the document, along with several nits. 
(If it'd be easier, and if you have the repository on GitHub, I can submit a PR 
for the nits.)

Comments:

- Section 2: Neither hard nor soft failures are used in the document. Can we just remove 
these terms altogether?
- Section 3: Perhaps it's worth mentioning that we consider the standard Dolev-Yao 
style attacker as outlined in RFC3552?
- Section 5, second paragraph: It looks the start of this sentence (or paragraph)
was accidentally deleted:

   he interoperability requirements for TCP ISNs are probably not
   clearly spelled out as one would expect.  

Nits:
    
- Abstract: "implications" seems like the wrong word. Perhaps "properties" can be
used instead? (That is, identifiers can affect security and privacy properties, not
affect *implications*. This is what's used in Section 1, too.)
- Section 1: s/the poor selection of the aforementioned/poor selection of numeric
- Section 1: The sentence, "While it is generally possible... is non-trivial" seems like
it can come at the *end* of the introduction, or removed altogether as it's redundant
with a later sentence in the same section.
- Section 1 (and elsewhere): and/or is not a word -- please use or.
- Section 1: it might help to clarify what is an "inappropriate" algorithm.
- Section 1: s/The analysis of such timelines indicate that/This analysis indicates that
- Section 4: s/The above mas been/The above has been
- Section 4: s/specification misses a/specification omits
- Section 4: s/This has resulted in virtually all/This resulted in many
- Section 4: In the December 2014 entry, it would be good to reference 
I-D.gont-6man-predictable-fragment-id specifically rather than say "the aforementioned
IETF Internet Draft".
- Section 5: s/leads to negative security and privacy implications/harms security 
and privacy properties (Let's make this change through the document, please!)
- Section 6: s/replacement of such flawed scheme/replacement of this flawed scheme
- Section 6: s/wg item of the 6man wg/WG item of the 6man WG (capitalize WG here and elsewhere)
- Section 7: s/The NTP [RFC5905] is employed to avoid/NTP [RFC5905] avoids
- Section 8: s/The proposal experiments/The proposal experiences
- Section 10: s/This document analyzes the timeline of the specification of different types of "numeric identifiers" used in IETF protocols/This document analyzes the timeline of IETF protocol "numeric identifiers"

---

From: "Christopher Wood" <[email-masked]>
Date: Sat, 28 Mar 2020 17:44:56 -0700

... with no hat on!

Best,
Chris

On Sat, Mar 28, 2020, at 5:44 PM, Christopher Wood wrote:
> Document: draft-irtf-pearg-numeric-ids-history-01 
> [https://tools.ietf.org/id/draft-irtf-pearg-numeric-ids-history-01.txt]
> 
> Assessment: Almost ready
> 
> - Section 10: s/This document analyzes the timeline of the 
> specification of different types of "numeric identifiers" used in IETF 
> protocols/This document analyzes the timeline of IETF protocol "numeric 
> identifiers"
>

---

From: Fernando Gont <[email-masked]>
Date: Sun, 29 Mar 2020 21:49:03 -0300

Hello, Chris,

Thanks a lot for your feedback! In-line!

> I think the overall point is made clear.

I'm curious about the omissions... which ones? If only for the sake of 
curiousity. :-)  (FWIW, for the most part we documented numeric IDs from 
different layers that we were closely involved in... not that there are 
not other, though!)

> (If it'd be easier, and if you have the repository on GitHub, I can submit a PR

Here it is: https://github.com/fgont/numeric-ids  . The working copy of 
the I-Ds are the ones with the "-latest" suffix.

> - Section 2: Neither hard nor soft failures are used in the document. Can we just remove

Definitely yes. Done!

> style attacker as outlined in RFC3552?

Does RFC3552 actually mention it?

>     clearly spelled out as one would expect.

s/he/The/ -- done, thanks!

> Nits:

[...]
I have not applied these yet. If you want, you can send pull requests. 
Otherwise I will incorporate these comments tomorrow.

Thanks a lot!

Cheers,
-- 
Fernando Gont
SI6 Networks
e-mail: [email-masked]
PGP Fingerprint: 6666 31C6 D484 63B2 8FB1 E3C4 AE25 0D55 1D4E 7492