Subject: [T2TRG] Editorial comments on draft-irtf-t2trg-iot-seccons

From: Ludwig Seitz <[email-masked]>
Date: Tue, 19 Sep 2017 15:26:50 +0200

Hello authors,

I've read your draft and found it to be a good overview of IoT security 
issues. I have only some small editorial comments:

Section 2
It is bad style to have an empty section immediately followed by a 
subsection. Please consider write some introductory sentence to section 2.

Section 3 bullet point 8
You could also name unlawful surveillance by intelligence agencies as a 
privacy threat, since that has become quite common.

Section 3 general
In the list of threats you could add something like "elevation of 
privilege" where an attacker with low privileges misuses some flaw in 
the security to gain more access than he was originally intended to have.

Section 4.1  the reference to [RFC6272] is not a link, so it's probably 
pure ASCII in the source of the draft. If you use xml use <xref ...> for 
that.

Page 18
The paragraph about EAP could re-cite RFC3748, but since it was cited 
before this is not strictly necessary.

Regards,

Ludwig

-- 
Ludwig Seitz, PhD
Security Lab, RISE SICS
Phone +46(0)70-349 92 51