Subject: Re: [secdir] Secdir early review of draft-ietf-idr-ext-opt-param-09

From: John Scudder <[email-masked]>
Date: Wed, 6 Jan 2021 16:14:23 +0000

Hi Nancy,

Thanks for your review. Comments below.

On Dec 17, 2020, at 8:24 PM, Nancy Cam-Winget via Datatracker <[email-masked]<mailto:[email-masked]>> wrote:

[External Email. Be cautious of content]

Reviewer: Nancy Cam-Winget
Review result: Ready

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

This document describes the allowance for the extended optional parameters in
BGP to be greater than 255.  As written, the document is straightforward and on
point. I only have an editorial nit and a suggestion.

NIT:
Section 2: 1st sentence of the 7th paragraph "that in the..." Needs to be fixed.
Should it be: "that is in the..."?

This is the paragraph:

   The subsequent one-octet field, that in the non-extended format would
   be the first Optional Parameter Type field, MUST be set to 255 on
   transmission.  On receipt, a value of 255 for this field is the
   indication that the extended format is in use.

I think it is correct as written, but I can see why it doesn’t scan well for everyone. We could rewrite as something like “The subsequent one-octet field (that would be the first Optional Parameter Type field in the non-extended format) MUST be set to 255 on transmission.”

What do you think? Clearer?

Suggestion:
- As new drafts need to include security and privacy considerations, I think it
would be good to just add in the security section (5) that it doesn't change
both underlying security or privacy issues as noted in RFC5272.

I think you must mean RFC 4272. I added “or confidentiality” instead of “or privacy”, since 4272 doesn’t address privacy by name at all. Reasonable?

Regards,

—John