From nobody Thu Apr 1 05:33:44 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id AF38E3A0E5A for ; Thu, 1 Apr 2021 05:33:43 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <161728042363.18442.4274291457358914411@ietfa.amsl.com> Date: Thu, 01 Apr 2021 05:33:43 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2021 12:33:44 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2021-04-08 Reviewer LC end Draft Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Russ Housley R2021-03-22 draft-ietf-acme-star-delegation Joseph Salowey R2021-02-09 draft-ietf-oauth-access-token-jwt Yaron Sheffer R2020-10-16 draft-ietf-tls-exported-authenticator Melinda Shore R2021-02-16 draft-ietf-bess-evpn-oam-req-frmwk Last calls: Reviewer LC end Draft John Bradley 2021-03-16 draft-ietf-idr-bgp-ls-registry Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Phillip Hallam-Baker 2019-12-13 draft-ietf-ace-oauth-authz Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Dan Harkins 2021-03-22 draft-ietf-6man-spring-srv6-oam Russ Housley R2021-03-22 draft-ietf-acme-star-delegation Leif Johansson None draft-ietf-netconf-crypto-types Aanchal Malhotra None draft-ietf-opsawg-l3sm-l3nm Catherine Meadows 2021-04-14 draft-ietf-ntp-interleaved-modes Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Sandra Murphy 2020-10-15 draft-ietf-tls-external-psk-importer Tim Polk None draft-ietf-opsawg-finding-geofeeds Joseph Salowey R2021-02-09 draft-ietf-oauth-access-token-jwt Yaron Sheffer R2020-10-16 draft-ietf-tls-exported-authenticator Melinda Shore R2021-02-16 draft-ietf-bess-evpn-oam-req-frmwk Carl Wallace R2021-02-22 draft-ietf-tcpm-2140bis Samuel Weiler 2021-02-22 draft-ietf-tls-dtls13 Brian Weis 2021-02-19 draft-ietf-lamps-cms-aes-gmac-alg Klaas Wierenga 2020-12-02 draft-ietf-core-echo-request-tag Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model Liang Xia 2021-03-17 draft-ietf-core-sid Early review requests: Reviewer Due Draft Scott Kelly 2021-04-01 draft-ietf-tcpm-accurate-ecn Tina Tsou 2021-02-15 draft-ietf-idr-eag-distribution Paul Wouters 2021-02-19 draft-ietf-idr-bgp-ls-app-specific-attr Dacheng Zhang 2020-12-07 draft-ietf-idr-eag-distribution Next in the reviewer rotation: Alexey Melnikov Daniel Migault Adam Montville Kathleen Moriarty Russ Mundy Sandra Murphy Yoav Nir Magnus Nystrom Hilarie Orman Radia Perlman From nobody Thu Apr 1 07:14:19 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B781A3A1381; Thu, 1 Apr 2021 07:14:11 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Russ Housley via Datatracker To: Cc: acme@ietf.org, draft-ietf-acme-star-delegation.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161728645169.22199.426466100825851383@ietfa.amsl.com> Reply-To: Russ Housley Date: Thu, 01 Apr 2021 07:14:11 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-acme-star-delegation-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 01 Apr 2021 14:14:12 -0000 Reviewer: Russ Housley Review result: Ready I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the Security Area Directors. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. Document: draft-ietf-acme-star-delegation-07 Reviewer: Russ Housley Review Date: 2021-04-01 IETF LC End Date: 2021-03-22 IESG Telechat date: 2021-04-08 Summary: Ready Thanks for addressing my comments on the previous version. Major Concerns: None Minor Concerns: None IDnits reports: ** Downref: Normative reference to an Informational RFC: RFC 2986 However, this is not a concern. RFC 2986 is in the Downref registry. From nobody Fri Apr 2 09:05:43 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 8E0773A1B89; Fri, 2 Apr 2021 09:05:38 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Yaron Sheffer via Datatracker To: Cc: draft-ietf-tls-exported-authenticator.all@ietf.org, last-call@ietf.org, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161737953853.16107.13360840429966992303@ietfa.amsl.com> Reply-To: Yaron Sheffer Date: Fri, 02 Apr 2021 09:05:38 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-tls-exported-authenticator-14 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 02 Apr 2021 16:05:39 -0000 Reviewer: Yaron Sheffer Review result: Has Issues After a bit of back and forth over my *two* previous SecDir requests, I'm afraid that my original comment has not yet been fully addressed. The IANA considerations section (Sec. 8.1) adds server_name as a possible extension for CertificateRequest. This would be a non-backward compatible change to TLS. IMO what we needed to do is both to clarify the allowed extensions for what Nick called "the CR-like structure" (almost done in Sec. 4, though the last sentence should by changed to include CertificateRequest) and undo the change to the TLS ExtensionType registry (not done, would require to remove Sec. 8.1). * Nit: this sentence is repeated almost verbatim in Sec. 4 and Sec. 5, and in both cases is mangled. Old: The application layer protocol used to send the authenticator request SHOULD use a secure with equivalent security to TLS, such as QUIC [QUIC-TLS], as its as its underlying transport to keep the request confidential. New: The application layer protocol used to send the authenticator request SHOULD use a secure *channel* with equivalent security to TLS, such as QUIC [QUIC-TLS], as its ~~as its~~ underlying transport to keep the request confidential. From nobody Sat Apr 3 12:15:54 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 119AC3A105A; Sat, 3 Apr 2021 12:15:45 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Melinda Shore via Datatracker To: Cc: bess@ietf.org, draft-ietf-bess-evpn-oam-req-frmwk.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161747734503.26070.3557524278951744460@ietfa.amsl.com> Reply-To: Melinda Shore Date: Sat, 03 Apr 2021 12:15:45 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-bess-evpn-oam-req-frmwk-07 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 03 Apr 2021 19:15:45 -0000 Reviewer: Melinda Shore Review result: Ready This revision addresses concerns I raised in the last review, and looks ready for publication. It's still a tidy little document - "well done" to the authors. From nobody Mon Apr 5 08:57:01 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 2AE343A1DCA; Mon, 5 Apr 2021 08:56:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -9.617 X-Spam-Level: X-Spam-Status: No, score=-9.617 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=CAI/hB3M; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=KPtsRc+W Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id LDg_hN8lCvVl; Mon, 5 Apr 2021 08:56:50 -0700 (PDT) Received: from alln-iport-4.cisco.com (alln-iport-4.cisco.com [173.37.142.91]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 7A21D3A1DC8; Mon, 5 Apr 2021 08:56:50 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=7044; q=dns/txt; s=iport; t=1617638210; x=1618847810; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=/X0wMqS/jeW23WqUlq6HwCDh6v1W8HsksUMmt48kAfU=; b=CAI/hB3MyFY/MM2JR7qnLq1lL7WVcT9TrctiAITZ0n65OIY7gXCXbXlV WCaYnjEQwWa5HWCS/x4g22P9LeiQdxzANWqdbIKDL9bmPjduyBOy/LUk5 loWDVmKZCQFI1xaT2EeHtqN0K8dtSHXWwgGsljm3a8Rcy56+JuOcd4Fe2 o=; X-IPAS-Result: =?us-ascii?q?A0AYAADvMmtgmJxdJa1aHAEBAQEBAQcBARIBAQQEAQFAg?= =?us-ascii?q?T4HAQELAYEiMFF+WjYxiAoDhFlgiE6URYR1gS6BJQNUCwEBAQ0BATICBAEBh?= =?us-ascii?q?FACgXwCJTQJDgIDAQEBAwIDAQEBAQEFAQEBAgEGBBQBAQEBAQEBAWiFUA2GR?= =?us-ascii?q?QZAAQE3AQ8CAQhGMiUCBAENBQiCaQGBflcDLwFMoH0Cih91gTSBAYIEAQEGh?= =?us-ascii?q?R4YghMJgTkBgnWCcRI+RoZPJxyBSUKBE0OCXz6EQoNKgiuBWD2BGQEDgVJkH?= =?us-ascii?q?xABEwWRJosRnU6BCwqDCohPjnOFVqRulRSePYRpAgICAgQFAg4BAQaBIzE4g?= =?us-ascii?q?VtwFYMkUBcCDo4fGYNXilgBczgCBgoBAQMJfIwoAQE?= IronPort-PHdr: A9a23:Lage2R/ltDPwpP9uWNHoyV9lXQAupqn0MwgJ65Eul7NJdOG58o//O FDEjd1iiVbIWcPQ7PcXw+bVsqW1X2sG7N7BtX0Za5VDWlcDjtlehA0vBsOJSCiZZP7nZiA3B oJOAVli+XzoPk1cGcK4bFrX8TW+6DcIEUD5Mgx4bu3+Bo/ViZGx0Oa/s53eaglFnnyze7R3e R63tg7W8MIRhNgKFw== IronPort-HdrOrdr: A9a23:mfcsHqkaIAOiJHBZNJAAEVSFIyvpDfN+jmdD5ilNYBxZY6Wkvu iUtrAyyQL0hDENWHsphNCHP+26TWnB8INuiLNxAZ6LZyOjnGezNolt4c/ZwzPmEzDj7eI178 ldWoBEIpnLAVB+5PyU3CCRGdwt2cTC1aiui/vXwXsFd3AUV4hLxW5Ce2GmO2dxQxRLAod8MZ Ka6NZOqTbIQwVoUu2QAH4ZU+/f4+DajZ6OW29JOzcLyimryQmp5rnzDgSC0n4lMw9n7L8+/Q H+4nfEz4q5tfXT8G6460by6NBslMLl2p9/AqW3+7QoAxHNrirtW4h7Qb2Fu1kO0aCSwXInis PFrRtlH+kb0QKqQkiPrRHg2xbt3V8VgheIozL18BiTw/DRfz40B9FMgohUaHLimjcdleth26 FG1X/xjeswMTr8nT/w79WNdxZmmlvcmwtbrccvjmdSWYZbVblJrYZ3xjItLL48GkvBmeQaOd grKPuZyOddcFucYXyclHJo2saQUnM6GQrDalQeu+SOugIm3ExR/g89/ogyj30A/JUyR91v/O LfKJllk7lIU4s/cb99PuEcWsG6Y1a9Ai7kASa3GxDKBasHM3XCp9rc+7Mu/tynf5QO0d8UlI neVkhb8Uo/YVjnB8HL/JAjyGGOfEyNGRDWju1O7ZlwvbPxAJDxNzeYdVwom8y85/oFBMnWXO uyJYJWD/fvIXCGI/cM4yTOH71pbVUOWswcvdg2H3iUpNjQF4HsvuvHNPbfTYCdVgoMayfaOD 8uTTLzLMJP4gSAQXnjmiXcXHvrZwj69ZJ0G67K4vgLxOE2R8txmzlQrW78ytCAKDVEvKBzVl B5OqnbnqSyonTz+33J4WVvMh9UFV1U/73kTnNPqWYxQgbJWIdGn+/aVXFZ3XOBKBM6ZdjRCh Rjq1N+/r/yM4ad3jk4C9WsMnuTinwaoH7ideZEpoSzoePePr8oBJcvX6J8UTjRHxtugABwtS NocwkfXHLSETvolISohJEZH/vkatF5mQunSPQk8U73hAG5n4UPTmFedyOyWcSX6DxeNgZ8tx lUyesjp5au3RyoMnAyhewkNkYkUhXmPJt2SCKfZItVnbj3fhpXVmniv03AtzgDPkz36k4Vmm vtaQqTdP2jOCsBhlloloD37VhzamKRO3hVV0k/m4h8GWPa00wDi9Ojbrav0meXd1sJyvwcNj aAejcJPgZy3bmMpW2osSfHGnM8ypo0OOvBSLwlbrHIw3uobJaFjKccApZvjdtYHcGrtu8ASu SEfQCJaDv+FuMywgSQz0xVcxVcuT0hkfny3gfi43X91HkjAeDKKFAjQ70AOdmT4yzlQPmPua 8Jx+4drK+1Mm/rbMSBxrySZzlfKgnLqWrzVvo2s/lvzNQPnao2G4OeXSrD1XlB0hl7JMDolF kGSKA+5LzaIIdgc8EbZioxxCtkqP2faE8w9gDmCO43el8gy2XWON6E+LLEo7siCE/pnnq5BX CPtylGu/vVVSqK0rAXT78qKWNNcU4m9TBs+viBe4C4MnTkS8hTuF6hdnmzf79WRPLbRfEerh Nm78qJmOHSfSziwwzUtSZ6JKUL82vPe7LHPCucXepTt9q9MhCQh6Hv5si5hjL+UyG6ZEQVnp ctTz1YUu1Tzj05yJQq2S2zQLHtqk0rk1FC8Shq/2Sdr7SO8SPeBwVaKgXXjZVdQClLPnWJhc rD9/KE1H6V2kkz5bDTUEFKft9PHNAMTo/4ayd2QPJgzoKVww== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.81,307,1610409600"; d="scan'208,217";a="664872859" Received: from rcdn-core-5.cisco.com ([173.37.93.156]) by alln-iport-4.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 05 Apr 2021 15:56:33 +0000 Received: from mail.cisco.com (xbe-aln-006.cisco.com [173.36.7.21]) by rcdn-core-5.cisco.com (8.15.2/8.15.2) with ESMTPS id 135FuXEF021717 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Mon, 5 Apr 2021 15:56:33 GMT Received: from xfe-rcd-001.cisco.com (173.37.227.249) by xbe-aln-006.cisco.com (173.36.7.21) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.3; Mon, 5 Apr 2021 10:56:32 -0500 Received: from xhs-rtp-003.cisco.com (64.101.210.230) by xfe-rcd-001.cisco.com (173.37.227.249) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.792.3; Mon, 5 Apr 2021 10:56:32 -0500 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (64.101.32.56) by xhs-rtp-003.cisco.com (64.101.210.230) with Microsoft SMTP Server (TLS) id 15.0.1497.2 via Frontend Transport; Mon, 5 Apr 2021 11:56:31 -0400 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=W3ZEyf18518ro4mE95S3uMI6YKyZKOlbdb6kcVOiWip0lr5Le2X5yu2an/s9oOTbOPAgAv7qoVOpV2u2g+9CJuTNEJTA4MJuXzKrw7MpGGt/2AN9abXfaRpkFQGp1Rdh3XisKbuQhALJsQ/1EngSsblo3+2+C0XnfZqtKMcGdQ+f1rOYCDM2Eky2daGIZwBbYwDeBB1lNXsYGX1fX1qSBq2v0Q6MBfXz0M9aq3ZlqSv+mx5JEM4Q9Tf3XBMWuIT4FtZ5Z26mmgCrf/oKSX8yj2fy/Hx+ON1BwSfGLPYUreGuAR/7vOI4sdy5GgQJt+0UOCDr+4hIizmGhOMVfx7ohA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uShvP5l5KB1nzmmqc5JWRtM7MhvyKlFmNs+kOpxBU9g=; b=fanY/dVBWBRj0IyygH/A0VA2puvr37GSuYs/iwfK6gwqkElHRM1emOgN+ugDpEo27JaBudd+tLbF7hi3wrmAHN+Ngu6TAfaneOerzXNnrGYEMbdGBckYyfWiLLVOnTDsPe6ip2zne1n2ZjkSuyG/K6f8jfxdQi0xHj/p1O84529Ex6y7zk5BeU3xNQDmAzmNkwnvVpRFEHQP2sfXlcW3ZB2ARJ0LmYIBuM6OT9WQStA78FFhrZVpe8hKIv5vp8jvw6QCfnv8YuUmTIX++OrbAyH1dLgoY5neTnRiFqhyYh2rxXIHb1jlkMjOHOW9gQQgkEpQNRayNbJdAE1SLOEmBg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=uShvP5l5KB1nzmmqc5JWRtM7MhvyKlFmNs+kOpxBU9g=; b=KPtsRc+WfGE5wkB7kpD6118v9mwsB/LM2esUaMxYZIbs26uXtP12Akv1TQcvXRaB8FsXLLj6a9zSRgxVmJ+1OqG4MoSdnya5x3/lc6l1NMY7leEEWFeBuvpkcHI2Tl0bYRWuPZNFgvYVXSpl93/xSzVKZH1Hwn6Bpp4aQt/A720= Received: from MW3PR11MB4651.namprd11.prod.outlook.com (2603:10b6:303:2c::21) by MWHPR1101MB2272.namprd11.prod.outlook.com (2603:10b6:301:51::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3999.28; Mon, 5 Apr 2021 15:56:30 +0000 Received: from MW3PR11MB4651.namprd11.prod.outlook.com ([fe80::208a:70ed:e449:e0d2]) by MW3PR11MB4651.namprd11.prod.outlook.com ([fe80::208a:70ed:e449:e0d2%9]) with mapi id 15.20.3999.032; Mon, 5 Apr 2021 15:56:30 +0000 From: "Tim Evens (tievens)" To: Chris Lonvick , "secdir@ietf.org" CC: "draft-ietf-grow-bmp-local-rib.all@ietf.org" , "grow@ietf.org" , "last-call@ietf.org" Thread-Topic: Secdir last call review of draft-ietf-grow-bmp-local-rib-10 Thread-Index: AQHXJO4LHucHUjNGLk2uTZnEGrmFQKqmHnRj Date: Mon, 5 Apr 2021 15:56:30 +0000 Message-ID: References: <161705827740.13468.11344469654269107377@ietfa.amsl.com> In-Reply-To: <161705827740.13468.11344469654269107377@ietfa.amsl.com> Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: authentication-results: gmail.com; dkim=none (message not signed) header.d=none;gmail.com; dmarc=none action=none header.from=cisco.com; x-originating-ip: [2601:600:c500:322:943:c48e:e1d8:efe2] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 4ae457b5-e0ad-42d1-9971-08d8f84b60c8 x-ms-traffictypediagnostic: MWHPR1101MB2272: x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:9508; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: MQObq1bDez6qIDgGS2vI4F+L5RMclKpo+I1P7vdrhdSu1eW7iw2wpkSYoe4eidsNu7Wu+XUJ7VDLwKEIrweCekXO1UnkQfToASuhwFOCNx1kXffrDFXz9MPyMjQ1qNSiCFX6k9hk1wu/v49LbCIrEePKq5ZkvsEAIYgXbmgK/ny4rWmtz4ZjTTqgpJbUh4fdrzvo8GGLy39gchMPK1EZmseMp219U3PZCBCmnWzb2GKWC7PVzz6yeYDrZXj0E2ZY9TsP1lgV1nGeIKCefc2V0mmu270FjxPkuC8ZXie3Vk9eTA6A8fJYDR0R7eRWka3SmjJog7FOqs87T196GXSGAurmeTHLSHMdT49eZtCewq6Fyl8KB1XztbMLzt5U38oYIvNK4lkbhyrkclxDzmW8jdFDmhV+1D+wmy//swR/VlruSubzXXmWa6Tvhxl3adUvKHvwTWWLdCJ1PZIgDXtKGrM0ipxNfakg7QgcuClB8bNBlYeXoETSqm+OQFDJ9LPOmgO9oQWSkdGqPSBkExaM10dtLGHnS+WVucx0+D80TBY4cHNRZaPJYguFEN9vjytlhwH8qIj7U+6nyk9hj4bm/pMOTDDb9Xe/iC07SmtIDiPYv0sfO8rM986gbItr1PDu5Jd3phEwqoBPI0ioNqavwg== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:MW3PR11MB4651.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(366004)(346002)(376002)(396003)(136003)(39860400002)(76116006)(7696005)(71200400001)(66946007)(8936002)(110136005)(66446008)(55016002)(316002)(53546011)(478600001)(9686003)(64756008)(52536014)(66556008)(8676002)(33656002)(186003)(66476007)(4326008)(54906003)(38100700001)(83380400001)(6506007)(2906002)(5660300002)(86362001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?us-ascii?Q?o8y0pElsvSW13h/GoMHElqJ6oq7jCNdRZaFJeVtGvA6gzOc3ReSeeVNZIdd5?= =?us-ascii?Q?ZQYCrIq3gTxrKP1FMsULQWuIoN8e/gDFayQhGuDietoA417W+3dWri2JcCh3?= =?us-ascii?Q?lbS+1kFC1uYp8Xbzm6ijUA4+WMUYbnldc5o/6lG1oQJ+mTWqNjk9c0mT3rb4?= =?us-ascii?Q?3tmqMbSkAlD/SeiSPfQuMxhb989DFGFqu4OZBgzscNlb96WaNdLEmqknXtMK?= =?us-ascii?Q?r5axN+BXo6PXJzQPq/10qun2Tdw6ZHLTADgyGMIwrCyVJjpx8AzB45RWNNMF?= =?us-ascii?Q?t0aIrtWB9O8nx3UFzQHgcsOF0NhulISUMbE1K0qTxcyKXYGTENqC11QRX5v4?= =?us-ascii?Q?FHewGBA6bEZqCLOoxfNXodSn4BCJjS8PkOAIatMp1wW5skXfJ4xLw1anWuXp?= =?us-ascii?Q?bVoSSG66Aij33sgaN2k7Twg5N4CBhI4GLnjoBPf89yFo6jhxMyL7fZBOnUAE?= =?us-ascii?Q?fkSuk1kRMSIK4WLgnG91CxE8usSzTR/QBnn7/az0KfOKTnaDEA8w0XW9ldDa?= =?us-ascii?Q?DXHxpurBeB18QhzPcigOg9eAXklX4qYs9spP2zEDGfhfwHGKndcjIDN6uV0Y?= =?us-ascii?Q?GJGYAcXc+1LTDblabgqqQlDyQr5x0b3yZ9CZ/uZczPsMIvMYoX5mdUlnj5vA?= =?us-ascii?Q?buRMOzw9hG5ka2aXhLtpR0SoAlEo49y32g+Jnx3DkV5i3ZNm7Xh1rSSxSnNJ?= =?us-ascii?Q?qHOrRia0JYMvjxFajfmOOuJ8XwWX4Pkfp2WOx2iGXD9nari9CbfNwbldbFG6?= =?us-ascii?Q?fLy+ySt013PdmaxAY8C8bp7pJ8KX7fS6KmyWb38u5uvruS8KXYVCOpH4jnjU?= =?us-ascii?Q?q0gGy4Le77lpC95eCduUBx3CMkngpvvN7m2Bbn5PWHRpbxg+X6yKn9gK3hon?= =?us-ascii?Q?IXzqMv2LOBrwzmAHPpLASN9uHtWUfuXilrUKu7xReirM8VpEBFuXyj0DWxCG?= =?us-ascii?Q?onYPkR7BJ3mKLTas4HgWwwkAfksONyp1YnJAprnT4EoC0RaU41Os852AR7l0?= =?us-ascii?Q?LMEuh410zf6fZe1WrHI6msoBG5ziVPTluBZcKX8CI6wPQKZyOxyWfQEMNOrp?= =?us-ascii?Q?qB2CZW+5nq4j3D9xpQlS0XgjdQOaTIiXN/JJSzbwX0400foy3iWLwNVVK/tv?= =?us-ascii?Q?qHEeMUPfqndHc1/NOqPFSShJAVrVta/PSr1hNSKcjv+2BiVprRytV/9DBxf4?= =?us-ascii?Q?3P7nLE/s7ZyfFe0k41kM8QmOFv6H/wPqPZZ+2KCrEk300BdG4zZXf3MvMCyy?= =?us-ascii?Q?74b0FwYp7h2Nz1u5K7ONWpMiO1egFlxIs3ZMElZ50WKjJZeKNNIaPNeingGf?= =?us-ascii?Q?0cn6pKJSGvGXxFXJEI+7ONa6KkgUmtFAoyXNdh9jKlrAZZ74wybFblmhGZPd?= =?us-ascii?Q?SClJkX4vaut86VxrrsW1SGuzjqIK?= x-ms-exchange-transport-forked: True Content-Type: multipart/alternative; boundary="_000_MW3PR11MB4651A85BDB432FAB23720D0DB6779MW3PR11MB4651namp_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: MW3PR11MB4651.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 4ae457b5-e0ad-42d1-9971-08d8f84b60c8 X-MS-Exchange-CrossTenant-originalarrivaltime: 05 Apr 2021 15:56:30.1844 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: GXK3TC6Bmx/t/cZNc3/IeFvGtnZBHdBY25yzrwQZlgC3lmycMLP3QdUyiXmYVAPlX/P/o2AeQ4KadrRYZNNYAQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: MWHPR1101MB2272 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.21, xbe-aln-006.cisco.com X-Outbound-Node: rcdn-core-5.cisco.com Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-grow-bmp-local-rib-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 05 Apr 2021 15:56:55 -0000 --_000_MW3PR11MB4651A85BDB432FAB23720D0DB6779MW3PR11MB4651namp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Thank you so much for your review. I have updated the doc per your suggest= ions. " The same considerations as in section 11 of [RFC7854] apply to this document. Implementations of this protocol SHOULD require monitored routers to establish secure sessions with authorized and trusted monitoring stations. It is also believed that this document does not add any features that require any additional security considerations." On 3/29/21, 3:51 PM, "Chris Lonvick via Datatracker" wro= te: Reviewer: Chris Lonvick Review result: Has Nits Hello, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area direct= ors. Document editors and WG chairs should treat these comments just like any o= ther last call comments. The summary of the review is READY. The authors state in the Security Considerations section that the same considerations that are documented in Section 11 of RFC 7854 also apply to = this document. I see no reason to doubt that and I believe that is appropriate f= or this document. The second and third sentences of the Security Considerations section may n= eed to be reworked. Although I skimmed the rest of the document, these were the only nits I could see. For the second sentence, rather than: Implementations of this protocol SHOULD require to establish sessions with authorized and trusted monitoring devices. Perhaps, Implementations of this protocol SHOULD require +monitored routers+ to establish +secure+ sessi= ons with authorized and trusted monitoring -devices-+stations+. The term "monitoring devices" is not used anywhere else in the document, and only on= ce in RFC 7854. On the other hand "monitoring stations" is used extensively in both. For the third sentence, rather than: It is also believed that this document does not add any additional security considerations. Perhaps, It is also believed that this document does not ad= d any +features that require any+ additional security considerations. Best regards, Chris --_000_MW3PR11MB4651A85BDB432FAB23720D0DB6779MW3PR11MB4651namp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Thank you so much for your review.  I have upda= ted the doc per your suggestions. 

 

"  The same considerations as in section 1= 1 of [RFC7854] apply to this

   document.  Implementations of this= protocol SHOULD require monitored

   routers to establish secure sessions wi= th authorized and trusted

   monitoring stations.  It is also b= elieved that this document does not

   add any features that require any addit= ional security considerations."

 

 

On 3/29/21, 3:51 PM, &quo= t;Chris Lonvick via Datatracker" <noreply@ietf.org> wrote:<= /o:p>



Reviewer: Chris Lonvick
Review result: Has Nits

Hello,

I have reviewed this document as part of the security directorate's ongoing=
effort to review all IETF documents being processed by the IESG.  Thes= e
comments were written primarily for the benefit of the security area direct= ors.
 Document editors and WG chairs should treat these comments just like = any other
last call comments.

The summary of the review is READY.

The authors state in the Security Considerations section that the same
considerations that are documented in Section 11 of RFC 7854 also apply to = this
document. I see no reason to doubt that and I believe that is appropriate f= or
this document.

The second and third sentences of the Security Considerations section may n= eed
to be reworked. Although I skimmed the rest of the document, these were the=
only nits I could see.

For the second sentence, rather than:
Implementations of this protocol SHOULD require to establish sessions with<= br> authorized and trusted monitoring devices. Perhaps, Implementations of this=
protocol SHOULD require  +monitored routers+  to establish  = +secure+  sessions
with authorized and trusted monitoring  -devices-+stations+. The term<= br> "monitoring devices" is not used anywhere else in the document, a= nd only once
in RFC 7854. On the other hand "monitoring stations" is used exte= nsively in
both.

For the third sentence, rather than:
It is also believed that this document does not add any additional security=
considerations. Perhaps, It is also believed that this document does not ad= d
any  +features that require any+  additional security considerati= ons.

Best regards,
Chris

--_000_MW3PR11MB4651A85BDB432FAB23720D0DB6779MW3PR11MB4651namp_-- From nobody Tue Apr 6 11:43:39 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id BD1843A2BEE; Tue, 6 Apr 2021 11:43:29 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.897 X-Spam-Level: X-Spam-Status: No, score=-1.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id TIEXeLiH4FQD; Tue, 6 Apr 2021 11:43:26 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id ADAF93A2BE8; Tue, 6 Apr 2021 11:43:25 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 136IhHJD019301 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 6 Apr 2021 14:43:22 -0400 Date: Tue, 6 Apr 2021 11:43:17 -0700 From: Benjamin Kaduk To: Yaron Sheffer Cc: secdir@ietf.org, draft-ietf-tls-exported-authenticator.all@ietf.org, last-call@ietf.org, tls@ietf.org Message-ID: <20210406184317.GU79563@kduck.mit.edu> References: <161737953853.16107.13360840429966992303@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <161737953853.16107.13360840429966992303@ietfa.amsl.com> Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-tls-exported-authenticator-14 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Apr 2021 18:43:30 -0000 Hi Yaron, Thanks for the (multiple!) reviews. My understanding is that the intention is not to allow "server_name" in all CertificateRequests but only specifically in the ClientCertificateRequest case. I think it can be helpful to notate that with a "CR" in the "TLS 1.3" column of the registry but we would need some further clarification as to what that notation actually means. I left some suggestions for how to do that in my ballot position, but to summarize: a "comment" column in the registry would be great for this, and failing that a note in the IANA Considerations of this document to clarify what is and is not being registered would probably work as well. Thanks again for highlighting this point, Ben On Fri, Apr 02, 2021 at 09:05:38AM -0700, Yaron Sheffer via Datatracker wrote: > Reviewer: Yaron Sheffer > Review result: Has Issues > > After a bit of back and forth over my *two* previous SecDir requests, I'm > afraid that my original comment has not yet been fully addressed. The IANA > considerations section (Sec. 8.1) adds server_name as a possible extension for > CertificateRequest. This would be a non-backward compatible change to TLS. > > IMO what we needed to do is both to clarify the allowed extensions for what > Nick called "the CR-like structure" (almost done in Sec. 4, though the last > sentence should by changed to include CertificateRequest) and undo the change > to the TLS ExtensionType registry (not done, would require to remove Sec. 8.1). > > * Nit: this sentence is repeated almost verbatim in Sec. 4 and Sec. 5, and in > both cases is mangled. > > Old: > > The application layer protocol used to send the authenticator request SHOULD > use a secure with equivalent security to TLS, such as QUIC [QUIC-TLS], as its > as its underlying transport to keep the request confidential. > > New: > > The application layer protocol used to send the authenticator request SHOULD > use a secure *channel* with equivalent security to TLS, such as QUIC > [QUIC-TLS], as its ~~as its~~ underlying transport to keep the request > confidential. > > From nobody Tue Apr 6 14:10:12 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DF2F23A3109; Tue, 6 Apr 2021 14:10:04 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.598 X-Spam-Level: X-Spam-Status: No, score=-0.598 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_BLOCKED=0.001, RCVD_IN_SORBS_WEB=1.5, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=gmail.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 1gzmJnWS94jR; Tue, 6 Apr 2021 14:10:03 -0700 (PDT) Received: from mail-wr1-x42f.google.com (mail-wr1-x42f.google.com [IPv6:2a00:1450:4864:20::42f]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id E61CF3A3108; Tue, 6 Apr 2021 14:10:02 -0700 (PDT) Received: by mail-wr1-x42f.google.com with SMTP id j18so15632870wra.2; Tue, 06 Apr 2021 14:10:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=user-agent:date:subject:from:to:cc:message-id:thread-topic :references:in-reply-to:mime-version:content-transfer-encoding; bh=CKgKjOjVgGtLgzHM3z6BmIWM4jokAwAGHu+3f59QOQs=; b=deFMsZc4xcsUYjhHA4Zq18AFaSndH8JoE7dwy4gXGdNthO5F7qxjfIAmK2RZhUdYIr pBIg5KH/RweJRJdatjHFD26b/iacoKSAEYll+bpfBIrn61R0hNtuy7LbqIwtu01iX3HE +BfZkAS0EI8YpCAi+40sN8UpEEVQM3yPcIcpBOhxSFV/CejdIX7EMC5PwR++TOlTOJHH pJE7l04PPXnmNgfDitysETceqezRg6DdfhhrOAMxdyAJsJPNF7P58zoJSDLigFdo6WRf 8ocrKh500KL7pwtxUJC7n/MRNXfO7Jjs2IN8ev9CGl51gBxV8Z1MNLIkaw15tJ4CI1De 3oww== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:cc:message-id :thread-topic:references:in-reply-to:mime-version :content-transfer-encoding; bh=CKgKjOjVgGtLgzHM3z6BmIWM4jokAwAGHu+3f59QOQs=; b=hlk+gk39RglppiuoYIaaMzz2SqLRU6WectjMtQQkdN3kkEri+rhPMXQ7bKywwmCJiY yEBXYy/ydIj0Odrw+IiJkbflmNZtOvkflVncmycmtcU/hjdFYQhAe4Mnzrhpkh/bA+Fr 5pXa1Ls4TJCzooKEXBhL2isqAqNyNoOrMPpKWKXN/H09+6bWIyMYUkMe8NdKYeXqq2ml 1uLsiyVzKFYnpfWwg/0qkwhvOf5uVHKCELA74B5/Ig+VpugZ/8O4r9aEdbO4iEQV6FYt meoq8+auQN5DMJMgw24yntEk5dlC6XqrnNBSuGUhPAJdEkVGjpprhad6Kx2njSx4hIwO x3JQ== X-Gm-Message-State: AOAM533hLWfv0lAN/RPYP6TnVmczwMo1PNr2ZzZVzR5o/qlpzEje/o32 huC32XjvmZB7aO5LfmO4l1jgmLA3+D/0Zw== X-Google-Smtp-Source: ABdhPJwxV8oPonnotY1DLF0SY4VfDEWUpxRJt0V8IqwqX8DZHkmiz5LwVuge/C54994KpyMksDKPmg== X-Received: by 2002:adf:f742:: with SMTP id z2mr211098wrp.130.1617743395949; Tue, 06 Apr 2021 14:09:55 -0700 (PDT) Received: from [192.168.68.107] (bzq-79-182-26-241.red.bezeqint.net. [79.182.26.241]) by smtp.gmail.com with ESMTPSA id b15sm34128498wrx.73.2021.04.06.14.09.54 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 06 Apr 2021 14:09:55 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.47.21031401 Date: Wed, 07 Apr 2021 00:09:54 +0300 From: Yaron Sheffer To: Benjamin Kaduk CC: , , , Message-ID: <08710817-AA38-49F4-A115-78C9D4D5F448@gmail.com> Thread-Topic: Secdir telechat review of draft-ietf-tls-exported-authenticator-14 References: <161737953853.16107.13360840429966992303@ietfa.amsl.com> <20210406184317.GU79563@kduck.mit.edu> In-Reply-To: <20210406184317.GU79563@kduck.mit.edu> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [secdir] Secdir telechat review of draft-ietf-tls-exported-authenticator-14 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 06 Apr 2021 21:10:05 -0000 I fully agree. Thank you Ben! =EF=BB=BFOn 4/6/21, 21:43, "Benjamin Kaduk" wrote: Hi Yaron, Thanks for the (multiple!) reviews. My understanding is that the intention is not to allow "server_name" in= all CertificateRequests but only specifically in the ClientCertificateReque= st case. I think it can be helpful to notate that with a "CR" in the "TLS 1.3" column of the registry but we would need some further clarificatio= n as to what that notation actually means. I left some suggestions for how = to do that in my ballot position, but to summarize: a "comment" column in = the registry would be great for this, and failing that a note in the IANA Considerations of this document to clarify what is and is not being registered would probably work as well. Thanks again for highlighting this point, Ben On Fri, Apr 02, 2021 at 09:05:38AM -0700, Yaron Sheffer via Datatracker= wrote: > Reviewer: Yaron Sheffer > Review result: Has Issues >=20 > After a bit of back and forth over my *two* previous SecDir requests,= I'm > afraid that my original comment has not yet been fully addressed. The= IANA > considerations section (Sec. 8.1) adds server_name as a possible exte= nsion for > CertificateRequest. This would be a non-backward compatible change to= TLS. >=20 > IMO what we needed to do is both to clarify the allowed extensions fo= r what > Nick called "the CR-like structure" (almost done in Sec. 4, though th= e last > sentence should by changed to include CertificateRequest) and undo th= e change > to the TLS ExtensionType registry (not done, would require to remove = Sec. 8.1). >=20 > * Nit: this sentence is repeated almost verbatim in Sec. 4 and Sec. 5= , and in > both cases is mangled. >=20 > Old: >=20 > The application layer protocol used to send the authenticator request= SHOULD > use a secure with equivalent security to TLS, such as QUIC [QUIC-TLS]= , as its > as its underlying transport to keep the request confidential. >=20 > New: >=20 > The application layer protocol used to send the authenticator request= SHOULD > use a secure *channel* with equivalent security to TLS, such as QUIC > [QUIC-TLS], as its ~~as its~~ underlying transport to keep the reques= t > confidential. >=20 >=20 From nobody Tue Apr 6 17:44:36 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id D6FBB3A37EE; Tue, 6 Apr 2021 17:44:34 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.499 X-Spam-Level: X-Spam-Status: No, score=-1.499 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, KHOP_HELO_FCRDNS=0.399, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id oqCw95mHAGP5; Tue, 6 Apr 2021 17:44:32 -0700 (PDT) Received: from outgoing.mit.edu (outgoing-auth-1.mit.edu [18.9.28.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6E12A3A37EA; Tue, 6 Apr 2021 17:44:32 -0700 (PDT) Received: from kduck.mit.edu ([24.16.140.251]) (authenticated bits=56) (User authenticated as kaduk@ATHENA.MIT.EDU) by outgoing.mit.edu (8.14.7/8.12.4) with ESMTP id 1370iPcP023791 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NOT); Tue, 6 Apr 2021 20:44:29 -0400 Date: Tue, 6 Apr 2021 17:44:24 -0700 From: Benjamin Kaduk To: Joseph Salowey Cc: secdir@ietf.org, draft-ietf-oauth-access-token-jwt.all@ietf.org Message-ID: <20210407004424.GW79563@kduck.mit.edu> References: <161272369978.20616.15063633580755015902@ietfa.amsl.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <161272369978.20616.15063633580755015902@ietfa.amsl.com> Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-oauth-access-token-jwt-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Apr 2021 00:44:35 -0000 Thanks for the review, Joe, and thanks Vittorio for the responses. With respect to (3), I did find one spot that seems to implicitly require bearer-token usage (we reference RFC 6750's error handling) that I mentioned in my No Objection ballot. -Ben On Sun, Feb 07, 2021 at 10:48:19AM -0800, Joseph Salowey via Datatracker wrote: > Reviewer: Joseph Salowey > Review result: Has Issues > > I have reviewed this document as part of the security directorate's > ongoing effort to review all IETF documents being processed by the > IESG. These comments were written primarily for the benefit of the > security area directors. Document editors and WG chairs should treat > these comments just like any other last call comments. > > The summary of the review is the document has issues. > > 1. (Editorial) What is the relationship between this document and RFC 7523. > They are using JWT for different purposes, but I think it would be useful to > clarify this in the introduction. > > 2. (Issue) The specification does not specify any mandatory to implement for > the recommended asymmetric algorithms. This will not help interop. Perhaps > specify one or both of "RS256" and "ES256". > > 3. (Question) Is it currently possible to use the JWT access token in a mode > other than a bearer token? For example is there a way to bind the JWT to a > verifiable key or identifier. If there is, there should be some discussion of > this in the security considerations. If not, do the authors know if there is > any work planned in this area? > > 4. Genart review pointed out a nit that should be fixed. > > > From nobody Thu Apr 8 12:00:36 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id D64273A18FF for ; Thu, 8 Apr 2021 12:00:28 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <161790842886.30346.17703156475427019389@ietfa.amsl.com> Date: Thu, 08 Apr 2021 12:00:28 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Apr 2021 19:00:35 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2021-04-08 Reviewer LC end Draft Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Joseph Salowey R2021-02-09 draft-ietf-oauth-access-token-jwt For telechat 2021-04-22 Reviewer LC end Draft Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Tero Kivinen R2021-03-31 draft-ietf-roll-aodv-rpl Last calls: Reviewer LC end Draft John Bradley 2021-03-16 draft-ietf-idr-bgp-ls-registry Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Phillip Hallam-Baker 2019-12-13 draft-ietf-ace-oauth-authz Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Dan Harkins 2021-03-22 draft-ietf-6man-spring-srv6-oam Leif Johansson None draft-ietf-netconf-crypto-types Tero Kivinen R2021-03-31 draft-ietf-roll-aodv-rpl Aanchal Malhotra None draft-ietf-opsawg-l3sm-l3nm Catherine Meadows 2021-04-14 draft-ietf-ntp-interleaved-modes Alexey Melnikov 2021-04-20 draft-ietf-dprive-xfr-over-tls Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Sandra Murphy 2020-10-15 draft-ietf-tls-external-psk-importer Tim Polk None draft-ietf-opsawg-finding-geofeeds Joseph Salowey R2021-02-09 draft-ietf-oauth-access-token-jwt Loganaden Velvindron 2021-04-22 draft-ietf-babel-yang-model Carl Wallace R2021-02-22 draft-ietf-tcpm-2140bis Samuel Weiler 2021-02-22 draft-ietf-tls-dtls13 Brian Weis 2021-02-19 draft-ietf-lamps-cms-aes-gmac-alg Klaas Wierenga 2020-12-02 draft-ietf-core-echo-request-tag Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model Liang Xia 2021-03-17 draft-ietf-core-sid Early review requests: Reviewer Due Draft Scott Kelly 2021-04-01 draft-ietf-tcpm-accurate-ecn Tina Tsou 2021-02-15 draft-ietf-idr-eag-distribution Paul Wouters 2021-02-19 draft-ietf-idr-bgp-ls-app-specific-attr Dacheng Zhang 2020-12-07 draft-ietf-idr-eag-distribution Next in the reviewer rotation: Daniel Migault Adam Montville Kathleen Moriarty Russ Mundy Sandra Murphy Yoav Nir Magnus Nystrom Hilarie Orman Radia Perlman Derrell Piper From nobody Thu Apr 8 13:04:03 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 9FA663A19B6 for ; Thu, 8 Apr 2021 13:03:58 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -2.098 X-Spam-Level: X-Spam-Status: No, score=-2.098 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_QP_LONG_LINE=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=unavailable autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=redhoundsoftware.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id MY-FrS7Bdwrq for ; Thu, 8 Apr 2021 13:03:54 -0700 (PDT) Received: from mail-qt1-x834.google.com (mail-qt1-x834.google.com [IPv6:2607:f8b0:4864:20::834]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 36DE33A19B5 for ; Thu, 8 Apr 2021 13:03:54 -0700 (PDT) Received: by mail-qt1-x834.google.com with SMTP id g24so2441394qts.6 for ; Thu, 08 Apr 2021 13:03:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhoundsoftware.com; s=google; h=user-agent:date:subject:from:to:message-id:thread-topic:references :in-reply-to:mime-version:content-transfer-encoding; bh=3zbLvu844uLjITvMu8rk4lq/zCx008a01pgu/Tnycx4=; b=o0EpN/aj7geEIqcaWGJD0Db9fe8DNKudR0+LVx9VPgR/+go5Te+X3NKXknywVURc/W E/7Noq+RTtbUZ/LNTtz7XNmDjILn1t0r1p5/ejZ7DQRlsO4XFbCopZjluYSGyG9RQD88 f+7/x+89nGrS1S+IHWmdC1XDhPviPwXMhQCSk= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:user-agent:date:subject:from:to:message-id :thread-topic:references:in-reply-to:mime-version :content-transfer-encoding; bh=3zbLvu844uLjITvMu8rk4lq/zCx008a01pgu/Tnycx4=; b=blbLlH2lYadyJb/ckmTIL37baBH7HUjTaBHeHYbsKbB6F/rfRxAePRPXTI/p5PzHtD YxdHNUpEHb69owQsXim7oasc1tiLMOy3Xc59AOZ/KM8mBPXCBedzrKIT3YzV7RpKS8uF Z6Bn81tbfL1gtK1TcduhqwzHNhGzkemsVjMlJHl6o25uj0fXqWVFM7diCd9xOuN1tIfT vbAcijGCxX21rwwnG9O2+gRne8Q1MZomL+gXF0SxbZHASVlhLYev6/z5+0Gq4kkY/bgu 2hjSDL0ewIU0VkmTwPjA/KG7Ph9km9hvQayGrzqbdkcVwZEVBbDPko0JZHNgG6bwsc91 LCnw== X-Gm-Message-State: AOAM5327UQzyGw0jFYNOIlps6eGYuAJ9aEzn96N4xGdO2W7vlI96Ld+l albAGtvrsGkZ4dEGsw3JTuyoyPjw3DIBFTXN X-Google-Smtp-Source: ABdhPJz1nuXgwvAJf6Xz0ao8HOsogrD7hHp9eHrJTWPGBEztxMe4OfjBtC6+0fw5ubP+GmjZlbeuhQ== X-Received: by 2002:ac8:68d:: with SMTP id f13mr9282569qth.300.1617912231431; Thu, 08 Apr 2021 13:03:51 -0700 (PDT) Received: from [192.168.2.17] (pool-108-18-106-102.washdc.fios.verizon.net. [108.18.106.102]) by smtp.gmail.com with ESMTPSA id q15sm364413qtx.47.2021.04.08.13.03.50 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 08 Apr 2021 13:03:50 -0700 (PDT) User-Agent: Microsoft-MacOutlook/16.47.21031401 Date: Thu, 08 Apr 2021 16:03:50 -0400 From: Carl Wallace To: , "iesg@ietf.org" , Message-ID: Thread-Topic: secdir review of draft-ietf-tcpm-2140bis References: <3780299D-34DB-4B6D-ABA4-BA579C946CA5@redhoundsoftware.com> In-Reply-To: <3780299D-34DB-4B6D-ABA4-BA579C946CA5@redhoundsoftware.com> Mime-version: 1.0 Content-type: text/plain; charset="UTF-8" Content-transfer-encoding: quoted-printable Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-tcpm-2140bis X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Apr 2021 20:03:59 -0000 I re-reviewed this document as part of the Security Directorate's ongoing e= ffort to review all IETF documents being processed by the IESG. These comme= nts were written primarily for the benefit of the Security Area Directors. = Document authors, document editors, and WG chairs should treat these comment= s just like any other IETF Last Call comments. I reviewed the changes made to address the genart review since my previous = review (below). The changes look fine to me. =EF=BB=BFOn 2/22/21, 6:43 AM, "Carl Wallace" wrote: I reviewed this document as part of the Security Directorate's ongoing = effort to review all IETF documents being processed by the IESG. These comm= ents were written primarily for the benefit of the Security Area Directors. = Document authors, document editors, and WG chairs should treat these commen= ts just like any other IETF Last Call comments. This document obsoletes RFC 2140. It provides a description of interdep= endent TCP control blocks and the ways that part of TCP state can be shared = among similar concurrent or consecutive connections. TCP state includes a co= mbination of parameters, such as connection state, current round-trip time = estimates, congestion control information, and process information.=20 I found no issues or nits with the document. The document is ready.=20 From nobody Thu Apr 8 14:53:23 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A564D3A1E44; Thu, 8 Apr 2021 14:53:21 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.901 X-Spam-Level: X-Spam-Status: No, score=-1.901 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hVNrqwwMR1LT; Thu, 8 Apr 2021 14:53:20 -0700 (PDT) Received: from www.goatley.com (www.goatley.com [198.137.202.94]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 164123A1E45; Thu, 8 Apr 2021 14:53:19 -0700 (PDT) Received: from trixy.bergandi.net (cpe-76-176-14-122.san.res.rr.com [76.176.14.122]) by wwwlocal.goatley.com (PMDF V6.8 #2433) with ESMTP id <0QR915J24M4TOA@wwwlocal.goatley.com>; Thu, 08 Apr 2021 16:53:17 -0500 (CDT) Received: from blockhead.local ([69.12.173.8]) by trixy.bergandi.net (PMDF V6.7-x01 #2433) with ESMTPSA id <0QR900D7SM4R5A@trixy.bergandi.net>; Thu, 08 Apr 2021 14:53:16 -0700 (PDT) Received: from 69-12-173-8.static.dsltransport.net ([69.12.173.8] EXTERNAL) (EHLO blockhead.local) with TLS/SSL by trixy.bergandi.net ([10.0.42.18]) (PreciseMail V3.3); Thu, 08 Apr 2021 14:53:16 -0700 Date: Thu, 08 Apr 2021 14:53:16 -0700 From: Dan Harkins To: last-call@ietf.org Cc: "secdir@ietf.org" , draft-ietf-6man-spring-srv6-oam.all@ietf.org Message-id: MIME-version: 1.0 Content-type: text/plain; charset=utf-8; format=flowed Content-language: en-US Content-transfer-encoding: 8BIT User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:78.0) Gecko/20100101 Thunderbird/78.7.1 X-PMAS-SPF: SPF check skipped for authenticated session (recv=trixy.bergandi.net, send-ip=69.12.173.8) X-PMAS-External-Auth: 69-12-173-8.static.dsltransport.net [69.12.173.8] (EHLO blockhead.local) X-PMAS-Software: PreciseMail V3.3 [210407b] (trixy.bergandi.net) X-PMAS-Allowed: system rule (rule allow header:X-PMAS-External noexists) Archived-At: Subject: [secdir] secdir review of draft-ietf-6man-spring-srv6-oam X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 08 Apr 2021 21:53:22 -0000   Hello,   First of all, my apologies for the tardiness of this review....   I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is (almost) Ready With Issues.   This draft defines a flag in the Segment Routing Header that when set will result a copy of the packet being made and forwarded for "telemetry data collection and export." That has tremendous security and privacy implications that are not mentioned at all in the Security Considerations. The Security Considerations just say that there's nothing here beyond those described in . I don't think that's the case.   Maybe I'm completely missing something but this sounds to me like it enables what we used to call "service spy mode" on a router-- take a flow and fork a copy off to someone else. I think there needs to be a lot more discussion of the implications of this.   Again, sorry for the tardiness of this review.   regards,   Dan. -- "The object of life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane." -- Marcus Aurelius From nobody Thu Apr 8 18:38:47 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 40A383A25B3; Thu, 8 Apr 2021 18:38:41 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: 1.07 X-Spam-Level: * X-Spam-Status: No, score=1.07 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HAS_X_OUTGOING_SPAM_STAT=2.388, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_HELO_NONE=0.001, SPF_NEUTRAL=0.779, URIBL_BLOCKED=0.001] autolearn=no autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (2048-bit key) header.d=strayalpha.com Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id FMZKC9Z8mSty; Thu, 8 Apr 2021 18:38:36 -0700 (PDT) Received: from server217-4.web-hosting.com (server217-4.web-hosting.com [198.54.116.98]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3497A3A25B1; Thu, 8 Apr 2021 18:38:36 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=strayalpha.com; s=default; h=To:References:Message-Id: Content-Transfer-Encoding:Cc:Date:In-Reply-To:From:Subject:Mime-Version: Content-Type:Sender:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Id: List-Help:List-Unsubscribe:List-Subscribe:List-Post:List-Owner:List-Archive; bh=vQeOb1r5iUlXxW+uLOzF72q/2JOGO4kEaNovoIUbEqc=; b=TjgvwUrWrj/fjgqRkq7Ne/e0N G+qG31hPfmaBQtSR6LK0MDTvR+FBDKLqESjmDGLtO2LJHoDYuNDiOJ9PEGrtbkgzl/+B5/fSvDlo+ 66DdGDtn2DWePWNYBGb9Q7sILX5S5VbWtWpTlSH/9041xlk3FUnL1RMheaiOVElWnyeAvG/NlWnlu kJ0jQzTwp+ndxflIg+KomyEe91AsZJ8uRrmES/cr8OyJV+OR19Va8zsuUb4eDouZI8qnQbIpxALeO VeZg2aOvcSzT4bD0x6v8bdPrCb1N2V0mWHinnMoPIThQUyytTaIpd6Abdyoek5GvBj3UqsondCRp2 Qd7x69PxQ==; Received: from cpe-172-250-225-198.socal.res.rr.com ([172.250.225.198]:64432 helo=[192.168.1.14]) by server217.web-hosting.com with esmtpsa (TLS1.2) tls TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (Exim 4.94) (envelope-from ) id 1lUg6R-000Bkq-2H; Thu, 08 Apr 2021 21:38:35 -0400 Content-Type: text/plain; charset=utf-8 Mime-Version: 1.0 (Mac OS X Mail 14.0 \(3654.60.0.2.21\)) From: Joseph Touch In-Reply-To: Date: Thu, 8 Apr 2021 18:38:29 -0700 Cc: secdir@ietf.org, "iesg@ietf.org" , draft-ietf-tcpm-2140bis.all@ietf.org Content-Transfer-Encoding: quoted-printable Message-Id: <5E6D4F1E-CA7C-4123-89D7-72F92E597E23@strayalpha.com> References: <3780299D-34DB-4B6D-ABA4-BA579C946CA5@redhoundsoftware.com> To: Carl Wallace X-Mailer: Apple Mail (2.3654.60.0.2.21) X-OutGoing-Spam-Status: No, score=-1.0 X-AntiAbuse: This header was added to track abuse, please include it with any abuse report X-AntiAbuse: Primary Hostname - server217.web-hosting.com X-AntiAbuse: Original Domain - ietf.org X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12] X-AntiAbuse: Sender Address Domain - strayalpha.com X-Get-Message-Sender-Via: server217.web-hosting.com: authenticated_id: touch@strayalpha.com X-Authenticated-Sender: server217.web-hosting.com: touch@strayalpha.com X-Source: X-Source-Args: X-Source-Dir: X-From-Rewrite: unmodified, already matched Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-tcpm-2140bis X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Apr 2021 01:38:41 -0000 Thank you, Carl. Joe > On Apr 8, 2021, at 1:03 PM, Carl Wallace = wrote: >=20 > I re-reviewed this document as part of the Security Directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written primarily for the benefit of the Security = Area Directors. Document authors, document editors, and WG chairs = should treat these comments just like any other IETF Last Call comments. >=20 > I reviewed the changes made to address the genart review since my = previous review (below). The changes look fine to me. >=20 > =EF=BB=BFOn 2/22/21, 6:43 AM, "Carl Wallace" = wrote: >=20 > I reviewed this document as part of the Security Directorate's = ongoing effort to review all IETF documents being processed by the IESG. = These comments were written primarily for the benefit of the Security = Area Directors. Document authors, document editors, and WG chairs = should treat these comments just like any other IETF Last Call comments. >=20 > This document obsoletes RFC 2140. It provides a description of = interdependent TCP control blocks and the ways that part of TCP state = can be shared among similar concurrent or consecutive connections. TCP = state includes a combination of parameters, such as connection state, = current round-trip time estimates, congestion control information, and = process information.=20 >=20 > I found no issues or nits with the document. The document is ready.=20= >=20 >=20 >=20 >=20 >=20 >=20 From nobody Thu Apr 8 21:03:04 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 30BEC3A2A7C; Thu, 8 Apr 2021 21:03:03 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Joseph Salowey via Datatracker To: Cc: draft-ietf-oauth-access-token-jwt.all@ietf.org, last-call@ietf.org, oauth@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161794098307.30044.1825515016931854191@ietfa.amsl.com> Reply-To: Joseph Salowey Date: Thu, 08 Apr 2021 21:03:03 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-oauth-access-token-jwt-12 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Apr 2021 04:03:03 -0000 Reviewer: Joseph Salowey Review result: Ready Thank you authors. This version addresses all my comments. From nobody Thu Apr 8 23:31:52 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C1B463A10E2; Thu, 8 Apr 2021 23:31:46 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -11.917 X-Spam-Level: X-Spam-Status: No, score=-11.917 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_MED=-2.3, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_NONE=0.001, URIBL_BLOCKED=0.001, USER_IN_DEF_DKIM_WL=-7.5] autolearn=ham autolearn_force=no Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=cisco.com header.b=G+FP1yh+; dkim=pass (1024-bit key) header.d=cisco.onmicrosoft.com header.b=N7lKxZQj Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id aeCJRrcOEPsc; Thu, 8 Apr 2021 23:31:41 -0700 (PDT) Received: from alln-iport-2.cisco.com (alln-iport-2.cisco.com [173.37.142.89]) (using TLSv1.2 with cipher DHE-RSA-SEED-SHA (128/128 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 95DA63A10AA; Thu, 8 Apr 2021 23:31:40 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=cisco.com; i=@cisco.com; l=14769; q=dns/txt; s=iport; t=1617949900; x=1619159500; h=from:to:cc:subject:date:message-id:references: in-reply-to:mime-version; bh=6gwjPh4FrHvwDI01T4RTN33I8yBlgj/snC44Xel4TwU=; b=G+FP1yh+pXVgSVfkoE/AetQUNbWshksBicM6ZkQoPXDMsaf3KC7JSxkj SrtqvtbugD+zxa2G+Cb6hlzMeTCl9q72pilvmr2kWRKXW5k5+G3cKb9iD 1AsHAIlhrMwCftNzh6PTjh3kshk1DWqJQ3U23/+kj3p+4Dz+kOxofpk1g Y=; X-IPAS-Result: =?us-ascii?q?A0DzAQBB9G9gmIENJK1aHAEBAQEBAQcBARIBAQQEAQGCE?= =?us-ascii?q?oEjMFF+WjYxCoQ4g0gDhTmILSUDii6KF4R2glMDVAsBAQENAQEqCAIEAQGEU?= =?us-ascii?q?AIXgWACJTgTAgMBAQEDAgMBAQEBAQUBAQECAQYEFAEBAQEBAQEBaIVQDYZEA?= =?us-ascii?q?QEBAQMjHQEBNwEPAgEIDgMDAQIrAgICHxEdCAIEAQ0FGYJYAYF+VwMvAQIMP?= =?us-ascii?q?p81Aoofd4EygQGCBAEBBoE3Ag5BgxkNC4ITAwaBOYJ2gnESPkYBAYZOJxyBS?= =?us-ascii?q?UKBEycMEIJfPoIeQgEBAgGBfQ2CajWCK4FYCWM4MgEDOBkCIoEqFy8BGBGRE?= =?us-ascii?q?wSDKodpjHiRBlsKgwuBIYcygRCNYYU4BB+DTYp4liyVFYtqgxaPQBOEVgIEA?= =?us-ascii?q?gQFAg4BAQaBI0ghgVtwFTsqAYI+UBcCDo4fGYNXhRSFRXMCNgIGAQkBAQMJf?= =?us-ascii?q?IsGAYEOAQE?= IronPort-PHdr: A9a23:62f+uBShMbYTLQDjX3l1j7QkEdpso0nLVj590bIulq5Of6K//p/rI E3Y47B3gUTUWZnAg9pAjPfQvK2mXnYPst6Ns3EHJZpLURJNycAbhBcpD8PND0rnZOXrYCo3E IUnNhdl8ni3PFITFJP4YFvf8Xm18DgdF1P4LwUmbujwE5TZ2sKw0e368pbPYgJO0Ty6Z746L Bi/oQjL8McMho43IacqwRyPqXxNKIxr IronPort-HdrOrdr: A9a23:i6LFCK3Aysb+Sp3jm6ppQQqjBfB2eYIsi2QD101hICF9Wvez0+ izgfUW0gL1gj4NWHcm3euNIrWEXGm0z/9IyKErF/OHUBP9sGWlaLtj44zr3iH6F0TFmNJ1/Z xLN5JzANiYNzdHpO7x6gWgDpIEyN6I7KiniY7lvghQZCtBApsQiDtRIACdD0FwWU1iDZ02CJ KT6qN81kSdUF4Qadm2AWRAYvjbq7Tw5dPbSDMlJzpi0gmBiju09KX3eiL54j4yWy5CqI1Sil TtvBf+4syYwpSG4z/ak1Te9pFH3Obmo+EzePCkrugwBnHShh2zZIJnMofy/AwdhO208l4lnJ 3tjn4bTr5OwkjcdG20vhfhsjOIuF1FhhOSqi77vVLZrcP0Xz48AcZa7LgpDyfx0VYqv913zc twrgSknqdXFh/JkWDc4NXFRnhR5zKJiEciiuIagjhjV5IfYtZq3PUi1X5Sea1weB7S2cQCKq 1DHcvc7PFZfRexdHbCpFRix9SqQzAaAgqGalJqgL3X7xFm2FRCi2cIzs0WmXkNsLgnTYNf2u jCOqN00JlTU84ta75nDutpe7r0NkX9BTb3dE6CK1XuE68Kf1jXrYTs3bkz7Oa2PLsF0YU1g5 aEdF9Dr2Y9dwbPBKS1rdh22yGIZF/4cSXmy8lY6ZQ8kKb7XqDXPSqKT01rnNCnp/kZH83HS/ e+MJ9bGJbYXCzTMLcM+ze7d4hZKHEYXsFQkM08QUiyrsXCLZCvtuGzSoeUGJPdVRIfHk/vCH oKWzb+YO9a6FqwZ3P+iB/NH3fkekn1+4NsALHXltJjkbQlB8lpiEw4mF657saEJXlpqaotZn ZzJ7vhj+e8vmm5/WHB6m1zIRpDBkNJ4LHtOkk64TMiAgfRS/Iuqt+fcWdd0D+sPRlkVf7bFw ZZuhBq466tNoeRwiojEtqjNWqfgxIo1Sq3ZqZZvpfGydbue5s+AJpjZbd4Eh/TEQdp3Sxwrn 1YVQMCTkjDNz/nhKm/lqYIDOXHe9QUunbxHedk7Vbk8WSVv4UGW2YSVT/Ga7/nvS8eAx5vwm BX34BaqryagjqrIXY4m40DQS1xQVXSJqlHAgSDbJhTgZbxdmhLPD23rA3frQ0vcWz38EhXoW rtIUSvCK32K2sYnGxE2aD3914xTEGhRgZbb3B3tpAVLxWahl96zfKLaq2v02GYd1sFxaUHPC vYZCYJSzketeyfyASYg3KLG3kg2/wVT5/gJaVmfLfJ1ny3LoqU0akAAv9P5Z5gcMvjq+kRTI ukCkCoBSK9D+MiwAqOoHk5fCFytXk/iPvtsSeVoVSQzTo6AfDIJk5hSKxeK9aA73L8T/LN1J lil9o6sa+xNWr2A+T2hZ3/fnpGKhnJp3SxQPxtoZdIvbgqvL82BoLFS1LzpTl69QR7KN2xmF IVQax97ryEMohzf9YKcyYc+lYyjtyAIEYirwSeOJ5xQXg9y3vAe9+Z6bvBrrQiRleMowb9Il GT+SxQ9fWtZVrI6ZcKT6YrZWhGYkk173pvuP6Yf4rLEQOwaqVN+kG5PnLVSs4VdIGVXbEL6h B07NGDk7XJK2722AXMsSB6JawL+WC9Ws+2CB+NH+kN89HSAyX6voK6pMqoyDHwQn+nbk5dg4 tPf0kZdN5ChTkvl5df6Fn4doXn5kY+10JD6jRmnEP30oeo4G3HDVhLWDep9ql+TH1WKDyUls zL/uiTyWTl7DVE0ZfFEl1MftsmIalncqHnayF0KcYRu7a0/60gxiRbCS1eelIBtA== X-IronPort-Anti-Spam-Filtered: true X-IronPort-AV: E=Sophos;i="5.82,208,1613433600"; d="scan'208,217";a="698776516" Received: from alln-core-9.cisco.com ([173.36.13.129]) by alln-iport-2.cisco.com with ESMTP/TLS/DHE-RSA-SEED-SHA; 09 Apr 2021 06:31:39 +0000 Received: from mail.cisco.com (xbe-aln-003.cisco.com [173.36.7.18]) by alln-core-9.cisco.com (8.15.2/8.15.2) with ESMTPS id 1396VdWp026834 (version=TLSv1.2 cipher=AES256-SHA bits=256 verify=OK); Fri, 9 Apr 2021 06:31:39 GMT Received: from xfe-rcd-005.cisco.com (173.37.227.253) by xbe-aln-003.cisco.com (173.36.7.18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.3; Fri, 9 Apr 2021 01:31:39 -0500 Received: from xfe-aln-001.cisco.com (173.37.135.121) by xfe-rcd-005.cisco.com (173.37.227.253) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.3; Fri, 9 Apr 2021 01:31:39 -0500 Received: from NAM11-DM6-obe.outbound.protection.outlook.com (173.37.151.57) by xfe-aln-001.cisco.com (173.37.135.121) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.792.3 via Frontend Transport; Fri, 9 Apr 2021 01:31:39 -0500 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=L3IJk9ULKG4Ke5Yn3on6iRj58LjmUCtY0IEbaVS0l+GEZ5w5U7G05/fC6pbXe/JmIi+akttnKbQf+rf6jBnPVZy4ijU+lXuLJQbwdFfLAAmInr75uvX5jc/hQdBEkpLCxYQGjXSxz3y9Kt9r18wvdSQRklnrWnUSj5ADjJbD83ma5Ab08tXc6I7r865xlC3sCapF8psl64tZBWbEhyrZOiwZdN5oZDu5W9YNDzOvnpRNcMea5JncQwJIBC6XZ4b4aSoIeZZ/DzHUYV9xcbnERdRGQiEurLSkCmKMboEhgRQfHU1zQcGmLVtelxVOhlWaw/+fDt0WfGJT1uRRe/xdSA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gwjPh4FrHvwDI01T4RTN33I8yBlgj/snC44Xel4TwU=; b=CDk7JusV7VtFnIdAtSFQzxI35Z/+JfcoK6PbIRxG3oOEcFPMxdVI9dA8brwAWvoCeXLAryj45ChOfpH8uHpdz1y5w0r11F1o4HPTBE0yEjYZXz8XYYdt/E5En8rX/QG9zLmQvzRYTO2mVBgw1fgrXojvaaV2gxX1Az59CJkeCkEUc+Ykncum9OPvcVRrz52N5dOvgTsR5foNyiX5DKmoNr0/y2j+viaax3l35o9tQtBd1rSX+VGOeSk2mY47k7tzKnvDVZBGN45B/G5LHogScrqFSJ8ZSWUvwvJI4iz+dN3LFrd3JSUBePMXgLiFNS9zpWkPjOJMcd59sCAit5C/jg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=cisco.com; dmarc=pass action=none header.from=cisco.com; dkim=pass header.d=cisco.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=cisco.onmicrosoft.com; s=selector2-cisco-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6gwjPh4FrHvwDI01T4RTN33I8yBlgj/snC44Xel4TwU=; b=N7lKxZQjX+Q5IouZGWGNutQ2TBVbzRHwOe23hAHBaXB1zxlZQkuhk1KiaXtOeCDki0EILUyhszIrlWSrwtSW3mXPhAPeXXMs3G++/ZIYDg502NEKj9jm+/VpZ8OgvZ+CB8OBzMeik7hqst8pozPEfqGMJQotoBDO6ZpCRzeP+YE= Received: from DM6PR11MB4692.namprd11.prod.outlook.com (2603:10b6:5:2aa::11) by DM6PR11MB3146.namprd11.prod.outlook.com (2603:10b6:5:67::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3999.29; Fri, 9 Apr 2021 06:31:38 +0000 Received: from DM6PR11MB4692.namprd11.prod.outlook.com ([fe80::9156:1513:54bf:2fe3]) by DM6PR11MB4692.namprd11.prod.outlook.com ([fe80::9156:1513:54bf:2fe3%9]) with mapi id 15.20.4020.016; Fri, 9 Apr 2021 06:31:37 +0000 From: "Zafar Ali (zali)" To: Dan Harkins , "last-call@ietf.org" CC: "secdir@ietf.org" , "draft-ietf-6man-spring-srv6-oam.all@ietf.org" , "Zafar Ali (zali)" Thread-Topic: secdir review of draft-ietf-6man-spring-srv6-oam Thread-Index: AQHXLMGd3yDuQxq5ZkmT+lZUpXaX5qqrd2qA Date: Fri, 9 Apr 2021 06:31:37 +0000 Message-ID: <3ECFC23D-9375-4CFA-8117-9EABE64CBC65@cisco.com> References: In-Reply-To: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: user-agent: Microsoft-MacOutlook/16.47.21031401 authentication-results: lounge.org; dkim=none (message not signed) header.d=none;lounge.org; dmarc=none action=none header.from=cisco.com; x-originating-ip: [47.185.233.68] x-ms-publictraffictype: Email x-ms-office365-filtering-correlation-id: 92c701e1-5a54-46a5-9c7d-08d8fb212108 x-ms-traffictypediagnostic: DM6PR11MB3146: x-ms-exchange-transport-forked: True x-microsoft-antispam-prvs: x-ms-oob-tlc-oobclassifiers: OLM:10000; x-ms-exchange-senderadcheck: 1 x-microsoft-antispam: BCL:0; x-microsoft-antispam-message-info: C44JRvfWYl9mySx76e15AVqwAUUIhrvJ51DcJsVSERvYQrKrJqmGzqzPY7XcO/Pua1WLNMx4i/TVuJgP2s/i4cFWZfmPTAdLjRj2r9wwT4X0Ax2urkG+iBZ9gcSlLhd9qWXVDTFVDFutTV6oE1zusf7t6G4DbAhOIgjTMIBmX+L3iOr2q1XbQw3RU//Ojas/SvNm3I7qX+UU+7qsyYHmR2+xEtvNwu9iKzWBlkrZx/mvqTO2t+Ie7KfXfG4XypmJOSsvWFqqFOxkYl/Gf+ogK4LWm4IO3574PUL9qZHA5ekldvwWJorj5dax96aNSHN5T0uadfnAR97fkMuZDGTxSnFdEZdFSuYJVQvtQ3gYtXejP79eV49nkb9gdww7qH+d014Xh+UiA3wtxg5Q1pksDwb41yhXEM+9L/D7W7DKUW0gFmJcPqcdLZuCNEhWWUXifjrJjLTXRbdPr0D/d+PO/XxMHnWardHew2gAYLqt8M8VgBh5LAe4SUeYxIgySZSnpLFMxQDYDYMSCGS8xMZrTIo8OyTM7/WYzAbcJCdAtyseMbqEs1+Vh/GJvaGOnVhpaOnh6TqAMsIwBKvlFxONsTOcDlvfcoIun8IUdwFj5CwEx2g8aDOkZK8NuGX+jCWSLsCWeFWWA9DW6Xt4bo9kTjcWZj6tg3klVrZ4LUDsZ8jZnUkHniPnf5L7BRG5+285DYBMftqcXUXujI9rJiqF8iPjYwHpDlkfPoosURzGS7pLN+IMjnsg0TWfh3ofFHmIkzIx7nczQmsuToY5C2PM6A== x-forefront-antispam-report: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:DM6PR11MB4692.namprd11.prod.outlook.com; PTR:; CAT:NONE; SFS:(396003)(346002)(366004)(136003)(376002)(39860400002)(8676002)(966005)(33656002)(478600001)(71200400001)(86362001)(76116006)(2906002)(66574015)(6486002)(83380400001)(110136005)(107886003)(316002)(66446008)(66556008)(66476007)(5660300002)(54906003)(64756008)(2616005)(66946007)(53546011)(36756003)(166002)(8936002)(6506007)(4326008)(26005)(9326002)(91956017)(186003)(38100700001)(6512007)(45980500001); DIR:OUT; SFP:1101; x-ms-exchange-antispam-messagedata: =?utf-8?B?bXhZZXRXL09ZVVNWZEZ6VUFVejZNWmdac1l3elNMWFVVSzFvSVJTOTExTmdD?= =?utf-8?B?T0p4STQrZmRkK2lNRURJWHh3amg2SnluZU8zSXRialB2U2wzV1ZSZ2J1QTZB?= =?utf-8?B?c3NvaW5qdlRUb0FTVVJXNUQwb1R6eU1VS3RqeW1HTU9VU3phK04zS3NTcndB?= =?utf-8?B?d1kwQkpXRHR5WGx4cFI2MDlUbEhCazNZTkdDNzZ3NXBWVmV1dE1KYlBLbEtl?= =?utf-8?B?b2FMeWhzSlV5M3BVRytFWitkUjFRbDE0ZzU4dVZVbGRVS1Z3Y21YYjlXaTFD?= =?utf-8?B?ZXJ4akRENFZneGZtTyt1RDBUOVVkWkE3YVpmSDVIbzhOQ2lhYXMxRVJhSjND?= =?utf-8?B?eXlHcE9kYTB6b25PUEUzYXR0cUpOSFRPTVRxalJ4V2pjYkRzU2dBR051WUM4?= =?utf-8?B?dGpydzVtaEFEMk14dHFoMnRGWkZoZkxXQ1JKOTBMcVBGYjlDV29YUEJlb2FH?= =?utf-8?B?UGZsbzJEYUtQQVl3a09IZWdvaFBwME5la2srdXRVYVFIT2Y0bnVucFlqTk43?= =?utf-8?B?NEg1M3Z1TkgzRGVUazQwZSsyY1MzVDFJTHNqWFJkVVNOY2FIbC9NejVpVXc3?= =?utf-8?B?eDhzTHp6WFdnT0RneTl6YkxJdDQrWnFFVXhKUngvWWVSWnRoanJHbyttL3Ux?= =?utf-8?B?Z0JVZGxIQW9PQWlLS1FGb1Zuamp2VTkvYk9yaGJ5Uis3VEJlTER3SHVpQXpm?= =?utf-8?B?cHJ0dTd2dlNXK09OWHNUZDBwMVRnTnNEeUdNbmFoVHlPNzkvZ05nT051WEtJ?= =?utf-8?B?aU81aTgzbnl4WEZudXVNT3BCYVE5ZlBEc1NwWityVlFyT0pIZFAvQjhnVGk4?= =?utf-8?B?MlowUUdlT0RieWNiOFIzUDR6RTI3WmpCSzlDL3oyaTZJbHgwakYvb01sd2Jq?= =?utf-8?B?QllCek41Qk5xYjdCL1NCRnNrVCtWMUY1WkxTM3J1TkFpRDRlNVhVWnhISmJX?= =?utf-8?B?L1E3bm8xSVlCc1Vqc05kazlORG1yZEJzU09CbXNtSXN0eGlVaW5vNjNUNUps?= =?utf-8?B?RHNQc3lkYXBMZktqb3liNDZaaGU3eDFMQjZKQkNmTUtOcHpiMUhoTXgwUE43?= =?utf-8?B?NXN6SHlzL0hSald5UzVXYnJITHZUVkF6K25HM0ltdk5odEZxM0NFZmIyRldF?= =?utf-8?B?T0pFZEtyTE85aWI1ellrZExUY2hITWlwdzMwV25rYmFhSlBuUmNTVVlneVRS?= =?utf-8?B?a1Qza3VBek5MdE5ZYVV6a3FjbTk5SkpsdnV2N3VYOHpNT2ZhaFNmZjBSUGNv?= =?utf-8?B?QWk0QlFuTmtMTXgydzFWTW02SUJxVVlUQ2srbllLVlpmWmZRSlBsNldPN0FL?= =?utf-8?B?anlnbk04OE81d0R3ZXBoUUJuSTFITVlpNzRqRm1Xd3dhRCtJUHl0YlhWNnhh?= =?utf-8?B?M0dTcitZMmVLQWZNOHR0YTduZjNtY2EzM2dJTjZqQVNVOWNGQkFkYXN6eVk2?= =?utf-8?B?enZpZ2RLZFd4ZDcrVlZ3NnVVczNVc210cHNyOUlEdzdyL0lsSU1ybC9rNHp5?= =?utf-8?B?QlRvanpLc2ZZSFpzUVk3eCs3b3dzTVJqRnNJTy91S1dSNVRYUjJNWEVaQW1D?= =?utf-8?B?cmpyNVdua0lVWGY2VmZZWFR4ekV0cG1KdmRhUWl1bkg0cXlBbG5FN2NZZkJF?= =?utf-8?B?N0U2dXBXVFJWOURSeU1CV2R6SXN2TTk0dEV3Y3Z0MHlUTnhpMWx0bDFVUXd2?= =?utf-8?B?RlJneHoxRVdJMGRETjBldnk5Q0JYSmpHMzI2M3gwcGROZmFLMEN5VVRwazZ2?= =?utf-8?B?RDdJY3BOUnVmaEFDMUNCQXZ1QVlsZ3Y4QUxUUkF3R1RVR0l5MXlKQk0yQ1Zu?= =?utf-8?B?V05xSGkxcEFRbnNnYmU0Zz09?= Content-Type: multipart/alternative; boundary="_000_3ECFC23D93754CFA81179EABE64CBC65ciscocom_" MIME-Version: 1.0 X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-AuthSource: DM6PR11MB4692.namprd11.prod.outlook.com X-MS-Exchange-CrossTenant-Network-Message-Id: 92c701e1-5a54-46a5-9c7d-08d8fb212108 X-MS-Exchange-CrossTenant-originalarrivaltime: 09 Apr 2021 06:31:37.8953 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: 5ae1af62-9505-4097-a69a-c1553ef7840e X-MS-Exchange-CrossTenant-mailboxtype: HOSTED X-MS-Exchange-CrossTenant-userprincipalname: OIX8E+tXHTWXx5goS9GZQROzLKt7Be0QJdvl25TgGn03DPXlAeB+0JKyU/1w5yq3 X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR11MB3146 X-OriginatorOrg: cisco.com X-Outbound-SMTP-Client: 173.36.7.18, xbe-aln-003.cisco.com X-Outbound-Node: alln-core-9.cisco.com Archived-At: Subject: Re: [secdir] secdir review of draft-ietf-6man-spring-srv6-oam X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 09 Apr 2021 06:31:50 -0000 --_000_3ECFC23D93754CFA81179EABE64CBC65ciscocom_ Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 SGkgRGFuLA0KDQpNYW55IHRoYW5rcyBmb3IgeW91ciBjb21tZW50cy4gR3JlYXRseSBhcHByZWNp YXRlZCENCg0KQXMgcGFydCBvZiBhZGRpdGlvbmFsIGNvbW1lbnRzIG9uIHJlY2VpdmVkIGR1cmlu ZyB0aGUgTEMsIHdlIHdlcmUgaXMgdGhlIHByb2Nlc3Mgb2YgdXBkYXRpbmcgdGhlIGRyYWZ0LCBp bmNsdWRpbmcgdGhlIHNlY3VyaXR5IHNlY3Rpb24uDQoNCldlIGp1c3QgcG9zdGVkIHJldiAxMCwg aHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1pZXRmLTZtYW4tc3By aW5nLXNydjYtb2FtLTEwDQpUaGUgc2VjdXJpdHkgc2VjdGlvbiBoYXMgYmVlbiB1cGRhdGVkLg0K DQpDYW4geW91IHBsZWFzZSByZXZpZXcgdGhlIHVwZGF0ZWQgc2VjdXJpdHkgc2VjdGlvbiBhbmQg YWR2aXNlIG9mIHlvdXIgY29tbWVudHM/DQoNClRoYW5rcw0KDQpSZWdhcmRzIOKApiBaYWZhcg0K DQpGcm9tOiBEYW4gSGFya2lucyA8ZGhhcmtpbnNAbG91bmdlLm9yZz4NCkRhdGU6IFRodXJzZGF5 LCBBcHJpbCA4LCAyMDIxIGF0IDU6NTMgUE0NClRvOiAibGFzdC1jYWxsQGlldGYub3JnIiA8bGFz dC1jYWxsQGlldGYub3JnPg0KQ2M6ICJzZWNkaXJAaWV0Zi5vcmciIDxzZWNkaXJAaWV0Zi5vcmc+ LCAiZHJhZnQtaWV0Zi02bWFuLXNwcmluZy1zcnY2LW9hbS5hbGxAaWV0Zi5vcmciIDxkcmFmdC1p ZXRmLTZtYW4tc3ByaW5nLXNydjYtb2FtLmFsbEBpZXRmLm9yZz4NClN1YmplY3Q6IHNlY2RpciBy ZXZpZXcgb2YgZHJhZnQtaWV0Zi02bWFuLXNwcmluZy1zcnY2LW9hbQ0KUmVzZW50LUZyb206IDxh bGlhcy1ib3VuY2VzQGlldGYub3JnPg0KUmVzZW50LVRvOiA8emFsaUBjaXNjby5jb20+LCA8Y2Zp bHNmaWxAY2lzY28uY29tPiwgPHNhdG9ydS5tYXRzdXNoaW1hQGcuc29mdGJhbmsuY28uanA+LCA8 ZGFuaWVsLnZveWVyQGJlbGwuY2E+LCA8bWFjaC5jaGVuQGh1YXdlaS5jb20+LCA8b3Ryb2FuQGVt cGxveWVlcy5vcmc+LCA8Ym9iLmhpbmRlbkBnbWFpbC5jb20+LCA8ZWsuaWV0ZkBnbWFpbC5jb20+ LCA8ZXZ5bmNrZUBjaXNjby5jb20+LCAib3RAY2lzY28uY29tIiA8b3RAY2lzY28uY29tPiwgIm90 QGNpc2NvLmNvbSIgPG90QGNpc2NvLmNvbT4NClJlc2VudC1EYXRlOiBUaHVyc2RheSwgQXByaWwg OCwgMjAyMSBhdCA1OjUzIFBNDQoNCg0KICBIZWxsbywNCg0KICBGaXJzdCBvZiBhbGwsIG15IGFw b2xvZ2llcyBmb3IgdGhlIHRhcmRpbmVzcyBvZiB0aGlzIHJldmlldy4uLi4NCg0KICBJIGhhdmUg cmV2aWV3ZWQgdGhpcyBkb2N1bWVudCBhcyBwYXJ0IG9mIHRoZSBzZWN1cml0eSBkaXJlY3RvcmF0 ZSdzDQpvbmdvaW5nIGVmZm9ydCB0byByZXZpZXcgYWxsIElFVEYgZG9jdW1lbnRzIGJlaW5nIHBy b2Nlc3NlZCBieSB0aGUNCklFU0cuICBUaGVzZSBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJpbWFy aWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGUNCnNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiAgRG9j dW1lbnQgZWRpdG9ycyBhbmQgV0cgY2hhaXJzIHNob3VsZCB0cmVhdA0KdGhlc2UgY29tbWVudHMg anVzdCBsaWtlIGFueSBvdGhlciBsYXN0IGNhbGwgY29tbWVudHMuDQoNClRoZSBzdW1tYXJ5IG9m IHRoZSByZXZpZXcgaXMgKGFsbW9zdCkgUmVhZHkgV2l0aCBJc3N1ZXMuDQoNCiAgVGhpcyBkcmFm dCBkZWZpbmVzIGEgZmxhZyBpbiB0aGUgU2VnbWVudCBSb3V0aW5nIEhlYWRlciB0aGF0IHdoZW4N CnNldCB3aWxsIHJlc3VsdCBhIGNvcHkgb2YgdGhlIHBhY2tldCBiZWluZyBtYWRlIGFuZCBmb3J3 YXJkZWQgZm9yDQoidGVsZW1ldHJ5IGRhdGEgY29sbGVjdGlvbiBhbmQgZXhwb3J0LiIgVGhhdCBo YXMgdHJlbWVuZG91cyBzZWN1cml0eQ0KYW5kIHByaXZhY3kgaW1wbGljYXRpb25zIHRoYXQgYXJl IG5vdCBtZW50aW9uZWQgYXQgYWxsIGluIHRoZSBTZWN1cml0eQ0KQ29uc2lkZXJhdGlvbnMuIFRo ZSBTZWN1cml0eSBDb25zaWRlcmF0aW9ucyBqdXN0IHNheSB0aGF0IHRoZXJlJ3MNCm5vdGhpbmcg aGVyZSBiZXlvbmQgdGhvc2UgZGVzY3JpYmVkIGluIDxsaXN0IG9mIG90aGVyIFJGQ3M+LiBJIGRv bid0DQp0aGluayB0aGF0J3MgdGhlIGNhc2UuDQoNCiAgTWF5YmUgSSdtIGNvbXBsZXRlbHkgbWlz c2luZyBzb21ldGhpbmcgYnV0IHRoaXMgc291bmRzIHRvIG1lIGxpa2UNCml0IGVuYWJsZXMgd2hh dCB3ZSB1c2VkIHRvIGNhbGwgInNlcnZpY2Ugc3B5IG1vZGUiIG9uIGEgcm91dGVyLS0gdGFrZQ0K YSBmbG93IGFuZCBmb3JrIGEgY29weSBvZmYgdG8gc29tZW9uZSBlbHNlLiBJIHRoaW5rIHRoZXJl IG5lZWRzIHRvIGJlDQphIGxvdCBtb3JlIGRpc2N1c3Npb24gb2YgdGhlIGltcGxpY2F0aW9ucyBv ZiB0aGlzLg0KDQogIEFnYWluLCBzb3JyeSBmb3IgdGhlIHRhcmRpbmVzcyBvZiB0aGlzIHJldmll dy4NCg0KICByZWdhcmRzLA0KDQogIERhbi4NCg0KLS0NCiJUaGUgb2JqZWN0IG9mIGxpZmUgaXMg bm90IHRvIGJlIG9uIHRoZSBzaWRlIG9mIHRoZSBtYWpvcml0eSwgYnV0IHRvDQplc2NhcGUgZmlu ZGluZyBvbmVzZWxmIGluIHRoZSByYW5rcyBvZiB0aGUgaW5zYW5lLiIgLS0gTWFyY3VzIEF1cmVs aXVzDQoNCg0K --_000_3ECFC23D93754CFA81179EABE64CBC65ciscocom_ Content-Type: text/html; charset="utf-8" Content-ID: Content-Transfer-Encoding: base64 PGh0bWwgeG1sbnM6bz0idXJuOnNjaGVtYXMtbWljcm9zb2Z0LWNvbTpvZmZpY2U6b2ZmaWNlIiB4 bWxuczp3PSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOm9mZmljZTp3b3JkIiB4bWxuczptPSJo dHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL29mZmljZS8yMDA0LzEyL29tbWwiIHhtbG5zPSJo dHRwOi8vd3d3LnczLm9yZy9UUi9SRUMtaHRtbDQwIj4NCjxoZWFkPg0KPG1ldGEgaHR0cC1lcXVp dj0iQ29udGVudC1UeXBlIiBjb250ZW50PSJ0ZXh0L2h0bWw7IGNoYXJzZXQ9dXRmLTgiPg0KPG1l dGEgbmFtZT0iR2VuZXJhdG9yIiBjb250ZW50PSJNaWNyb3NvZnQgV29yZCAxNSAoZmlsdGVyZWQg bWVkaXVtKSI+DQo8c3R5bGU+PCEtLQ0KLyogRm9udCBEZWZpbml0aW9ucyAqLw0KQGZvbnQtZmFj ZQ0KCXtmb250LWZhbWlseToiQ2FtYnJpYSBNYXRoIjsNCglwYW5vc2UtMToyIDQgNSAzIDUgNCA2 IDMgMiA0O30NCkBmb250LWZhY2UNCgl7Zm9udC1mYW1pbHk6Q2FsaWJyaTsNCglwYW5vc2UtMToy IDE1IDUgMiAyIDIgNCAzIDIgNDt9DQovKiBTdHlsZSBEZWZpbml0aW9ucyAqLw0KcC5Nc29Ob3Jt YWwsIGxpLk1zb05vcm1hbCwgZGl2Lk1zb05vcm1hbA0KCXttYXJnaW46MGluOw0KCWZvbnQtc2l6 ZToxMS4wcHQ7DQoJZm9udC1mYW1pbHk6IkNhbGlicmkiLHNhbnMtc2VyaWY7fQ0KYTpsaW5rLCBz cGFuLk1zb0h5cGVybGluaw0KCXttc28tc3R5bGUtcHJpb3JpdHk6OTk7DQoJY29sb3I6IzA1NjND MTsNCgl0ZXh0LWRlY29yYXRpb246dW5kZXJsaW5lO30NCnNwYW4uRW1haWxTdHlsZTE4DQoJe21z by1zdHlsZS10eXBlOnBlcnNvbmFsLXJlcGx5Ow0KCWZvbnQtZmFtaWx5OiJDYWxpYnJpIixzYW5z LXNlcmlmOw0KCWNvbG9yOndpbmRvd3RleHQ7fQ0Kc3Bhbi5hcHBsZS1jb252ZXJ0ZWQtc3BhY2UN Cgl7bXNvLXN0eWxlLW5hbWU6YXBwbGUtY29udmVydGVkLXNwYWNlO30NCi5Nc29DaHBEZWZhdWx0 DQoJe21zby1zdHlsZS10eXBlOmV4cG9ydC1vbmx5Ow0KCWZvbnQtc2l6ZToxMC4wcHQ7fQ0KQHBh Z2UgV29yZFNlY3Rpb24xDQoJe3NpemU6OC41aW4gMTEuMGluOw0KCW1hcmdpbjoxLjBpbiAxLjBp biAxLjBpbiAxLjBpbjt9DQpkaXYuV29yZFNlY3Rpb24xDQoJe3BhZ2U6V29yZFNlY3Rpb24xO30N Ci0tPjwvc3R5bGU+DQo8L2hlYWQ+DQo8Ym9keSBsYW5nPSJFTi1VUyIgbGluaz0iIzA1NjNDMSIg dmxpbms9IiM5NTRGNzIiIHN0eWxlPSJ3b3JkLXdyYXA6YnJlYWstd29yZCI+DQo8ZGl2IGNsYXNz PSJXb3JkU2VjdGlvbjEiPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+SGkgRGFuLCA8bzpwPjwvbzpw PjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5NYW55IHRoYW5rcyBmb3Ig eW91ciBjb21tZW50cy4gR3JlYXRseSBhcHByZWNpYXRlZCE8c3BhbiBjbGFzcz0iYXBwbGUtY29u dmVydGVkLXNwYWNlIj4mbmJzcDs8bzpwPjwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0KPHAgY2xh c3M9Ik1zb05vcm1hbCI+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+PHNwYW4g c3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPiZuYnNwOzwvbzpwPjwvc3Bhbj48L3NwYW4+PC9wPg0K PHAgY2xhc3M9Ik1zb05vcm1hbCI+PHNwYW4gY2xhc3M9ImFwcGxlLWNvbnZlcnRlZC1zcGFjZSI+ PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj5BcyBwYXJ0IG9mIGFkZGl0aW9uYWwgY29tbWVudHMg b24gcmVjZWl2ZWQgZHVyaW5nIHRoZSBMQywgd2Ugd2VyZSBpcyB0aGUgcHJvY2VzcyBvZiB1cGRh dGluZyB0aGUgZHJhZnQsIGluY2x1ZGluZyB0aGUgc2VjdXJpdHkgc2VjdGlvbi4NCjwvc3Bhbj48 L3NwYW4+PHNwYW4gc3R5bGU9ImNvbG9yOmJsYWNrIj48bzpwPjwvbzpwPjwvc3Bhbj48L3A+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIiBzdHlsZT0iY2FyZXQtY29sb3I6IHJnYigwLCAwLCAwKTtmb250 LXZhcmlhbnQtY2Fwczogbm9ybWFsO29ycGhhbnM6IGF1dG87dGV4dC1hbGlnbjpzdGFydDt3aWRv d3M6IGF1dG87LXdlYmtpdC10ZXh0LXNpemUtYWRqdXN0OiBhdXRvOy13ZWJraXQtdGV4dC1zdHJv a2Utd2lkdGg6IDBweDt3b3JkLXNwYWNpbmc6MHB4Ij4NCjxzcGFuIHN0eWxlPSJjb2xvcjpibGFj ayI+Jm5ic3A7PG86cD48L286cD48L3NwYW4+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCIgc3R5 bGU9ImNhcmV0LWNvbG9yOiByZ2IoMCwgMCwgMCk7Zm9udC12YXJpYW50LWNhcHM6IG5vcm1hbDtv cnBoYW5zOiBhdXRvO3RleHQtYWxpZ246c3RhcnQ7d2lkb3dzOiBhdXRvOy13ZWJraXQtdGV4dC1z aXplLWFkanVzdDogYXV0bzstd2Via2l0LXRleHQtc3Ryb2tlLXdpZHRoOiAwcHg7d29yZC1zcGFj aW5nOjBweCI+DQo8c3BhbiBzdHlsZT0iY29sb3I6YmxhY2siPldlIGp1c3QgcG9zdGVkIHJldiAx MCwgPGEgaHJlZj0iaHR0cHM6Ly9kYXRhdHJhY2tlci5pZXRmLm9yZy9kb2MvaHRtbC9kcmFmdC1p ZXRmLTZtYW4tc3ByaW5nLXNydjYtb2FtLTEwIj4NCmh0dHBzOi8vZGF0YXRyYWNrZXIuaWV0Zi5v cmcvZG9jL2h0bWwvZHJhZnQtaWV0Zi02bWFuLXNwcmluZy1zcnY2LW9hbS0xMDwvYT48bzpwPjwv bzpwPjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6 YmxhY2siPlRoZSBzZWN1cml0eSBzZWN0aW9uIGhhcyBiZWVuIHVwZGF0ZWQuDQo8bzpwPjwvbzpw Pjwvc3Bhbj48L3A+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48c3BhbiBzdHlsZT0iY29sb3I6Ymxh Y2siPjxvOnA+Jm5ic3A7PC9vOnA+PC9zcGFuPjwvcD4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxz cGFuIHN0eWxlPSJjb2xvcjpibGFjayI+Q2FuIHlvdSBwbGVhc2UgcmV2aWV3IHRoZSB1cGRhdGVk IHNlY3VyaXR5IHNlY3Rpb24gYW5kIGFkdmlzZSBvZiB5b3VyIGNvbW1lbnRzPw0KPC9zcGFuPjxv OnA+PC9vOnA+PC9wPg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhhbmtzPG86cD48L286cD48L3A+DQo8cCBj bGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPHAgY2xhc3M9 Ik1zb05vcm1hbCI+UmVnYXJkcyDigKYgWmFmYXIgPG86cD48L286cD48L3A+DQo8cCBjbGFzcz0i TXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjxkaXYgc3R5bGU9ImJvcmRlcjpub25l O2JvcmRlci10b3A6c29saWQgI0I1QzRERiAxLjBwdDtwYWRkaW5nOjMuMHB0IDBpbiAwaW4gMGlu Ij4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxiPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIuMHB0 O2NvbG9yOmJsYWNrIj5Gcm9tOiA8L3NwYW4+PC9iPjxzcGFuIHN0eWxlPSJmb250LXNpemU6MTIu MHB0O2NvbG9yOmJsYWNrIj5EYW4gSGFya2lucyAmbHQ7ZGhhcmtpbnNAbG91bmdlLm9yZyZndDs8 YnI+DQo8Yj5EYXRlOiA8L2I+VGh1cnNkYXksIEFwcmlsIDgsIDIwMjEgYXQgNTo1MyBQTTxicj4N CjxiPlRvOiA8L2I+JnF1b3Q7bGFzdC1jYWxsQGlldGYub3JnJnF1b3Q7ICZsdDtsYXN0LWNhbGxA aWV0Zi5vcmcmZ3Q7PGJyPg0KPGI+Q2M6IDwvYj4mcXVvdDtzZWNkaXJAaWV0Zi5vcmcmcXVvdDsg Jmx0O3NlY2RpckBpZXRmLm9yZyZndDssICZxdW90O2RyYWZ0LWlldGYtNm1hbi1zcHJpbmctc3J2 Ni1vYW0uYWxsQGlldGYub3JnJnF1b3Q7ICZsdDtkcmFmdC1pZXRmLTZtYW4tc3ByaW5nLXNydjYt b2FtLmFsbEBpZXRmLm9yZyZndDs8YnI+DQo8Yj5TdWJqZWN0OiA8L2I+c2VjZGlyIHJldmlldyBv ZiBkcmFmdC1pZXRmLTZtYW4tc3ByaW5nLXNydjYtb2FtPGJyPg0KPGI+UmVzZW50LUZyb206IDwv Yj4mbHQ7YWxpYXMtYm91bmNlc0BpZXRmLm9yZyZndDs8YnI+DQo8Yj5SZXNlbnQtVG86IDwvYj4m bHQ7emFsaUBjaXNjby5jb20mZ3Q7LCAmbHQ7Y2ZpbHNmaWxAY2lzY28uY29tJmd0OywgJmx0O3Nh dG9ydS5tYXRzdXNoaW1hQGcuc29mdGJhbmsuY28uanAmZ3Q7LCAmbHQ7ZGFuaWVsLnZveWVyQGJl bGwuY2EmZ3Q7LCAmbHQ7bWFjaC5jaGVuQGh1YXdlaS5jb20mZ3Q7LCAmbHQ7b3Ryb2FuQGVtcGxv eWVlcy5vcmcmZ3Q7LCAmbHQ7Ym9iLmhpbmRlbkBnbWFpbC5jb20mZ3Q7LCAmbHQ7ZWsuaWV0ZkBn bWFpbC5jb20mZ3Q7LCAmbHQ7ZXZ5bmNrZUBjaXNjby5jb20mZ3Q7LCAmcXVvdDtvdEBjaXNjby5j b20mcXVvdDsgJmx0O290QGNpc2NvLmNvbSZndDssDQogJnF1b3Q7b3RAY2lzY28uY29tJnF1b3Q7 ICZsdDtvdEBjaXNjby5jb20mZ3Q7PGJyPg0KPGI+UmVzZW50LURhdGU6IDwvYj5UaHVyc2RheSwg QXByaWwgOCwgMjAyMSBhdCA1OjUzIFBNPG86cD48L286cD48L3NwYW4+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBIZWxsbyw8bzpwPjwvbzpwPjwv cD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+ PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IEZpcnN0IG9m IGFsbCwgbXkgYXBvbG9naWVzIGZvciB0aGUgdGFyZGluZXNzIG9mIHRoaXMgcmV2aWV3Li4uLjxv OnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4m bmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJz cDsgSSBoYXZlIHJldmlld2VkIHRoaXMgZG9jdW1lbnQgYXMgcGFydCBvZiB0aGUgc2VjdXJpdHkg ZGlyZWN0b3JhdGUnczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1z b05vcm1hbCI+b25nb2luZyBlZmZvcnQgdG8gcmV2aWV3IGFsbCBJRVRGIGRvY3VtZW50cyBiZWlu ZyBwcm9jZXNzZWQgYnkgdGhlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5JRVNHLiZuYnNwOyBUaGVzZSBjb21tZW50cyB3ZXJlIHdyaXR0ZW4gcHJp bWFyaWx5IGZvciB0aGUgYmVuZWZpdCBvZiB0aGU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRp dj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPnNlY3VyaXR5IGFyZWEgZGlyZWN0b3JzLiZuYnNwOyBE b2N1bWVudCBlZGl0b3JzIGFuZCBXRyBjaGFpcnMgc2hvdWxkIHRyZWF0PG86cD48L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj50aGVzZSBjb21tZW50cyBqdXN0 IGxpa2UgYW55IG90aGVyIGxhc3QgY2FsbCBjb21tZW50cy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9k aXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+VGhlIHN1bW1hcnkgb2YgdGhlIHJldmll dyBpcyAoYWxtb3N0KSBSZWFkeSBXaXRoIElzc3Vlcy48bzpwPjwvbzpwPjwvcD4NCjwvZGl2Pg0K PGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5ic3A7PC9vOnA+PC9wPg0KPC9kaXY+ DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7IFRoaXMgZHJhZnQgZGVmaW5lcyBh IGZsYWcgaW4gdGhlIFNlZ21lbnQgUm91dGluZyBIZWFkZXIgdGhhdCB3aGVuPG86cD48L286cD48 L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5zZXQgd2lsbCByZXN1bHQg YSBjb3B5IG9mIHRoZSBwYWNrZXQgYmVpbmcgbWFkZSBhbmQgZm9yd2FyZGVkIGZvcjxvOnA+PC9v OnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+JnF1b3Q7dGVsZW1l dHJ5IGRhdGEgY29sbGVjdGlvbiBhbmQgZXhwb3J0LiZxdW90OyBUaGF0IGhhcyB0cmVtZW5kb3Vz IHNlY3VyaXR5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5hbmQgcHJpdmFjeSBpbXBsaWNhdGlvbnMgdGhhdCBhcmUgbm90IG1lbnRpb25lZCBhdCBh bGwgaW4gdGhlIFNlY3VyaXR5PG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj5Db25zaWRlcmF0aW9ucy4gVGhlIFNlY3VyaXR5IENvbnNpZGVyYXRpb25z IGp1c3Qgc2F5IHRoYXQgdGhlcmUnczxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAg Y2xhc3M9Ik1zb05vcm1hbCI+bm90aGluZyBoZXJlIGJleW9uZCB0aG9zZSBkZXNjcmliZWQgaW4g Jmx0O2xpc3Qgb2Ygb3RoZXIgUkZDcyZndDsuIEkgZG9uJ3Q8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPnRoaW5rIHRoYXQncyB0aGUgY2FzZS48bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPjxvOnA+Jm5i c3A7PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+Jm5ic3A7 IE1heWJlIEknbSBjb21wbGV0ZWx5IG1pc3Npbmcgc29tZXRoaW5nIGJ1dCB0aGlzIHNvdW5kcyB0 byBtZSBsaWtlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9y bWFsIj5pdCBlbmFibGVzIHdoYXQgd2UgdXNlZCB0byBjYWxsICZxdW90O3NlcnZpY2Ugc3B5IG1v ZGUmcXVvdDsgb24gYSByb3V0ZXItLSB0YWtlPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+ DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj5hIGZsb3cgYW5kIGZvcmsgYSBjb3B5IG9mZiB0byBzb21l b25lIGVsc2UuIEkgdGhpbmsgdGhlcmUgbmVlZHMgdG8gYmU8bzpwPjwvbzpwPjwvcD4NCjwvZGl2 Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmEgbG90IG1vcmUgZGlzY3Vzc2lvbiBvZiB0 aGUgaW1wbGljYXRpb25zIG9mIHRoaXMuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8 cCBjbGFzcz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4N CjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZuYnNwOyBBZ2Fpbiwgc29ycnkgZm9yIHRoZSB0YXJkaW5l c3Mgb2YgdGhpcyByZXZpZXcuPG86cD48L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFz cz0iTXNvTm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNs YXNzPSJNc29Ob3JtYWwiPiZuYnNwOyByZWdhcmRzLDxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8 ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4N CjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4mbmJzcDsgRGFuLjxvOnA+PC9vOnA+PC9wPg0K PC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05vcm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+ DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNvTm9ybWFsIj4tLSA8bzpwPjwvbzpwPjwvcD4N CjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPiZxdW90O1RoZSBvYmplY3Qgb2Yg bGlmZSBpcyBub3QgdG8gYmUgb24gdGhlIHNpZGUgb2YgdGhlIG1ham9yaXR5LCBidXQgdG88bzpw PjwvbzpwPjwvcD4NCjwvZGl2Pg0KPGRpdj4NCjxwIGNsYXNzPSJNc29Ob3JtYWwiPmVzY2FwZSBm aW5kaW5nIG9uZXNlbGYgaW4gdGhlIHJhbmtzIG9mIHRoZSBpbnNhbmUuJnF1b3Q7IC0tIE1hcmN1 cyBBdXJlbGl1czxvOnA+PC9vOnA+PC9wPg0KPC9kaXY+DQo8ZGl2Pg0KPHAgY2xhc3M9Ik1zb05v cm1hbCI+PG86cD4mbmJzcDs8L286cD48L3A+DQo8L2Rpdj4NCjxkaXY+DQo8cCBjbGFzcz0iTXNv Tm9ybWFsIj48bzpwPiZuYnNwOzwvbzpwPjwvcD4NCjwvZGl2Pg0KPC9kaXY+DQo8L2JvZHk+DQo8 L2h0bWw+DQo= --_000_3ECFC23D93754CFA81179EABE64CBC65ciscocom_-- From nobody Mon Apr 12 07:53:46 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 47AAD3A2233; Mon, 12 Apr 2021 07:53:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: Cc: draft-ietf-roll-aodv-rpl.all@ietf.org, last-call@ietf.org, roll@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.27.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161823921524.12303.16717431883070401287@ietfa.amsl.com> Reply-To: Tero Kivinen Date: Mon, 12 Apr 2021 07:53:35 -0700 Archived-At: Subject: [secdir] Secdir telechat review of draft-ietf-roll-aodv-rpl-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 12 Apr 2021 14:53:41 -0000 Reviewer: Tero Kivinen Review result: Has Nits This is rereview of this document. Some of my comments from the previous review were not properly implemented. I.e., even when the figure changed the reserved field in section 4.3 to be 'X' instead of 'r', the text listing fields still refers to it as 'r'. Also the acronym format is not not consistent, i.e., either pick format of "long name (ACRONYM)" or "ACRONYM (long name)", and do not use both of them. Now there is still acronyms RPL, DIO, and MOP in section 1 using different format than what for example acronyms DODAG, P2P, DAO in same section. From nobody Mon Apr 12 17:03:33 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id C80DA3A17AF for ; Mon, 12 Apr 2021 17:03:27 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.899 X-Spam-Level: X-Spam-Status: No, score=-1.899 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, RCVD_IN_MSPIKE_H2=-0.001, SPF_HELO_NONE=0.001, SPF_NONE=0.001] autolearn=unavailable autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id C8oF_UtsYPNv for ; Mon, 12 Apr 2021 17:03:25 -0700 (PDT) Received: from smtp99.iad3a.emailsrvr.com (smtp99.iad3a.emailsrvr.com [173.203.187.99]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 3D5043A17B0 for ; Mon, 12 Apr 2021 17:03:25 -0700 (PDT) Received: from app3.wa-webapps.iad3a (relay-webapps.rsapps.net [172.27.255.140]) by smtp37.relay.iad3a.emailsrvr.com (SMTP Server) with ESMTP id 11CAC5B0E; Mon, 12 Apr 2021 20:03:24 -0400 (EDT) Received: from hyperthought.com (localhost.localdomain [127.0.0.1]) by app3.wa-webapps.iad3a (Postfix) with ESMTP id EC288A1EFB; Mon, 12 Apr 2021 20:03:23 -0400 (EDT) Received: by apps.rackspace.com (Authenticated sender: scott@hyperthought.com, from: scott@hyperthought.com) with HTTP; Mon, 12 Apr 2021 17:03:23 -0700 (PDT) X-Auth-ID: scott@hyperthought.com Date: Mon, 12 Apr 2021 17:03:23 -0700 (PDT) From: "Scott G. Kelly" To: "secdir@ietf.org" , "iesg@ietf.org" , draft-ietf-tcpm-accurate-ecn.all@ietf.org MIME-Version: 1.0 Content-Type: text/plain;charset=UTF-8 Content-Transfer-Encoding: quoted-printable Importance: Normal X-Priority: 3 (Normal) X-Type: plain X-Client-IP: 24.23.138.127 Message-ID: <1618272203.965227355@apps.rackspace.com> X-Mailer: webmail/18.1.26-RC X-Classification-ID: 98d08108-5b1d-4829-bd34-67ead449e8c4-1-1 Archived-At: Subject: [secdir] secdir review of draft-ietf-tcpm-accurate-ecn-14 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Apr 2021 00:03:28 -0000 I have reviewed this document as part of the security directorate's ongoing= effort to review all IETF documents being processed by the IESG. These co= mments were written primarily for the benefit of the security area director= s. Document editors and WG chairs should treat these comments just like an= y other last call comments.=0A=0AThe summary of the review is Almost Ready.= =0A=0AThe title of this draft is, "More Accurate ECN Feedback in TCP". The = document specifies a scheme (abbreviated AccECN) to provide more than one f= eedback signal per RTT in the TCP header. It does this by allocating a rese= rved header bit that was previously used for the ECN-Nonce (which has now b= een declared historic), and it overloads the two existing ECN flags in the = TCP header.=0A=0AI'm not a TCP or ECN expert, so please take my comments wi= th a proverbial grain of salt. Thinking about this strictly as a security g= eek, I see three places where this scheme could be tampered with: the sende= r, the receiver, and the network in between them. =0A=0AThe security consid= erations section starts off by pointing out that there will be consequences= to tampering by a middlebox (the network in between), and it describes the= impact as limited. =0A=0AA malicious sender is not described, and I'm not = sure that any such thing reasonably exists, but I did wonder about this.=0A= =0AA malicious receiver (who might be motivated to interfere with AccECN in= order to increase its own throughput at the expense of others) is describe= d, and the reader is referred to section 5.3, which describes 3 different p= otential mitigations for this. There is also mention of the fact that the r= eceiver might simply omit the option, pretending it had been stripped by a = middlebox, but there is no known consequence (other than downgrading to pla= in ECN).=0A=0AThere is a TODO in the security considerations which must be = addressed (referring to a potential covert channel), and that's why the rev= iew summary is "Almost Ready". I suggest that the security AD might want so= meone both TCP and security expertise to evaluate this. =0A=0A=0A--Scott=0A From nobody Tue Apr 13 19:24:30 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6C2B63A0C2A; Mon, 12 Apr 2021 23:39:10 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1618295950; bh=QmfEPmFvUveMvC5Qz1IpjbnoBS9qeVZjzaPwZ87n+GY=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=jaEMGrXVvq93NqJVVibRe3BnRBJCSdgDTnFkXJLmFvx2Itw/fpN9zjpEy3Q/8sNgC J8zXprWev3pcdAtlyZF5ckRYonLqj4GpEyeW+KSVyvgPC3MoOfiImrlbShuFFbaMJa xhnshVtYHRnZ7NLRDEbRRiGzGTZXhnnoi3NTKmS0= X-Mailbox-Line: From new-work-bounces@ietf.org Mon Apr 12 23:39:04 2021 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id B532E3A0CCC; Mon, 12 Apr 2021 23:39:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1618295943; bh=QmfEPmFvUveMvC5Qz1IpjbnoBS9qeVZjzaPwZ87n+GY=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=cu9NEdfGiSdWpdlfGjsx1JA2UjzLkebxaD+JjwyJHbjC3VYzRvPrRmBwG47jc6I0X 1ZM0bs4p0B4xKRuEmitVXcClRoloqpof0v7STA55lUshSEZgj2l7AHrMfM9rzT2NDQ ZhzcGY5C3H9holH6v1Evq3QZB/N6Xs7LmhtRY7zU= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id DFF9A3A0C33 for ; Mon, 12 Apr 2021 23:38:55 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -5.9 X-Spam-Level: X-Spam-Status: No, score=-5.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_HI=-5, SPF_PASS=-0.001, URIBL_BLOCKED=0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id prGmvP3IlssK for ; Mon, 12 Apr 2021 23:38:51 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id C7BC73A0BFA for ; Mon, 12 Apr 2021 23:38:51 -0700 (PDT) Received: from [89.187.161.155] (helo=jiaxueyuandeMacBook-Pro.local) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lWChF-00070i-Jd for new-work@ietf.org; Tue, 13 Apr 2021 06:38:49 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <100cabf0-bb26-a54c-ac52-465811085d50@w3.org> Date: Tue, 13 Apr 2021 14:38:46 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Tue, 13 Apr 2021 19:24:29 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Web Editing Working Group (until 2021-05-11/12) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 13 Apr 2021 06:39:17 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBXZWIgRWRp dGluZyBXb3JraW5nIEdyb3VwOgogwqAgaHR0cHM6Ly93M2MuZ2l0aHViLmlvL2VkaXRpbmcvY2hh cnRlci1kcmFmdHMvZWRpdGluZy0yMDIxLmh0bWwKCkFzIHBhcnQgb2YgZW5zdXJpbmcgdGhhdCB0 aGUgY29tbXVuaXR5IGlzIGF3YXJlIG9mIHByb3Bvc2VkIHdvcmsKYXQgVzNDLCB0aGlzIGRyYWZ0 IGNoYXJ0ZXIgaXMgcHVibGljIGR1cmluZyB0aGUgQWR2aXNvcnkKQ29tbWl0dGVlIHJldmlldyBw ZXJpb2QuCgpXM0MgaW52aXRlcyBwdWJsaWMgY29tbWVudHMgdGhyb3VnaCAwMzo1OSBVVEMgb24g MjAyMS0wNS0xMgooMjM6NTksIEJvc3RvbiB0aW1lIG9uIDIwMjEtNS0xMSkgb24gdGhlIHByb3Bv c2VkIGNoYXJ0ZXIuClBsZWFzZSBzZW5kIGNvbW1lbnRzIHRvIHB1YmxpYy1uZXctd29ya0B3My5v cmcsCndoaWNoIGhhcyBhIHB1YmxpYyBhcmNoaXZlOgogwqAgaHR0cDovL2xpc3RzLnczLm9yZy9B cmNoaXZlcy9QdWJsaWMvcHVibGljLW5ldy13b3JrLwoKT3RoZXIgdGhhbiBjb21tZW50cyBzZW50 IGluIGZvcm1hbCByZXNwb25zZXMgYnkgVzNDIEFkdmlzb3J5CkNvbW1pdHRlZSBSZXByZXNlbnRh dGl2ZXMsIFczQyBjYW5ub3QgZ3VhcmFudGVlIGEgcmVzcG9uc2UgdG8KY29tbWVudHMuIElmIHlv dSB3b3JrIGZvciBhIFczQyBNZW1iZXIgWzFdLCBwbGVhc2UgY29vcmRpbmF0ZQp5b3VyIGNvbW1l bnRzIHdpdGggeW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUuIEZvcgpleGFt cGxlLCB5b3UgbWF5IHdpc2ggdG8gbWFrZSBwdWJsaWMgY29tbWVudHMgdmlhIHRoaXMgbGlzdCBh bmQKaGF2ZSB5b3VyIEFkdmlzb3J5IENvbW1pdHRlZSBSZXByZXNlbnRhdGl2ZSByZWZlciB0byBp dCBmcm9tIGhpcwpvciBoZXIgZm9ybWFsIHJldmlldyBjb21tZW50cy4KCklmIHlvdSBzaG91bGQg aGF2ZSBhbnkgcXVlc3Rpb25zIG9yIG5lZWQgZnVydGhlciBpbmZvcm1hdGlvbiwgcGxlYXNlCmNv bnRhY3QgWGlhb3FpYW4gV3UsIFRlYW0gQ29udGFjdCBmb3IgdGhlIHByb3Bvc2VkIGdyb3VwLCA8 eGlhb3FpYW5AdzMub3JnPi4KClRoYW5rIHlvdSwKClh1ZXl1YW4gSmlhLCBXM0MgTWFya2V0aW5n ICYgQ29tbXVuaWNhdGlvbnMKClsxXSBodHRwOi8vd3d3LnczLm9yZy9Db25zb3J0aXVtL01lbWJl ci9MaXN0CgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fXwpu ZXctd29yayBtYWlsaW5nIGxpc3QKbmV3LXdvcmtAaWV0Zi5vcmcKaHR0cHM6Ly93d3cuaWV0Zi5v cmcvbWFpbG1hbi9saXN0aW5mby9uZXctd29yawo= From nobody Thu Apr 15 14:27:22 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id E408D3A30C1 for ; Thu, 15 Apr 2021 14:27:20 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <161852204086.14419.13584886105344034647@ietfa.amsl.com> Date: Thu, 15 Apr 2021 14:27:20 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Apr 2021 21:27:21 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2021-04-22 Reviewer LC end Draft Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Carl Wallace R2020-08-26 draft-ietf-stir-cert-delegation Last calls: Reviewer LC end Draft John Bradley 2021-03-16 draft-ietf-idr-bgp-ls-registry Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Phillip Hallam-Baker 2019-12-13 draft-ietf-ace-oauth-authz Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Leif Johansson None draft-ietf-netconf-crypto-types Aanchal Malhotra None draft-ietf-opsawg-l3sm-l3nm Catherine Meadows 2021-04-14 draft-ietf-ntp-interleaved-modes Daniel Migault 2021-04-29 draft-ietf-bess-datacenter-gateway Adam Montville 2021-04-28 draft-ietf-core-new-block Kathleen Moriarty 2021-04-27 draft-ietf-bess-mvpn-msdp-sa-interoperation Russ Mundy 2021-04-20 draft-ietf-dprive-xfr-over-tls Sandra Murphy 2020-10-15 draft-ietf-tls-external-psk-importer Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Tim Polk None draft-ietf-opsawg-finding-geofeeds Loganaden Velvindron 2021-04-22 draft-ietf-babel-yang-model Carl Wallace R2021-02-22 draft-ietf-tcpm-2140bis Carl Wallace R2020-08-26 draft-ietf-stir-cert-delegation Samuel Weiler 2021-02-22 draft-ietf-tls-dtls13 Brian Weis 2021-02-19 draft-ietf-lamps-cms-aes-gmac-alg Klaas Wierenga 2020-12-02 draft-ietf-core-echo-request-tag Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model Liang Xia 2021-03-17 draft-ietf-core-sid Early review requests: Reviewer Due Draft Tina Tsou 2021-02-15 draft-ietf-idr-eag-distribution Paul Wouters 2021-02-19 draft-ietf-idr-bgp-ls-app-specific-attr Dacheng Zhang 2020-12-07 draft-ietf-idr-eag-distribution Next in the reviewer rotation: Yoav Nir Magnus Nystrom Hilarie Orman Radia Perlman Derrell Piper Tim Polk Tirumaleswar Reddy.K Vincent Roca Kyle Rose Joseph Salowey From nobody Sat Apr 17 17:15:32 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 900CF3A268D; Thu, 15 Apr 2021 09:44:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1618505099; bh=rskGVu6YxywavOZh+hdnsRVKlg47PJYlRgd/7osTirI=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ie7paRo6lOSHNB37/9vISAtCHewUAxLuSZTZ+kbkYZeG1ivqXSFIhLIaMhsBIA6UB d/G96ePuDJORQAH1Ie7Hrv/D40FnHw4tdUZkAVsJg5/GRaZkifdTz0aKH6cLobfHgi ZLO6TS0Pa5sstYRzKJj/kGoqnVKhkr7Z7I0wQqMY= X-Mailbox-Line: From new-work-bounces@ietf.org Thu Apr 15 09:44:59 2021 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 01BE43A267E; Thu, 15 Apr 2021 09:44:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1618505099; bh=rskGVu6YxywavOZh+hdnsRVKlg47PJYlRgd/7osTirI=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=ie7paRo6lOSHNB37/9vISAtCHewUAxLuSZTZ+kbkYZeG1ivqXSFIhLIaMhsBIA6UB d/G96ePuDJORQAH1Ie7Hrv/D40FnHw4tdUZkAVsJg5/GRaZkifdTz0aKH6cLobfHgi ZLO6TS0Pa5sstYRzKJj/kGoqnVKhkr7Z7I0wQqMY= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id E380C3A268F for ; Thu, 15 Apr 2021 09:44:56 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.9 X-Spam-Level: X-Spam-Status: No, score=-0.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 2SnhfLO3LL2P for ; Thu, 15 Apr 2021 09:44:54 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 4FC133A2689 for ; Thu, 15 Apr 2021 09:44:54 -0700 (PDT) Received: from [1.58.159.214] (helo=[192.168.0.101]) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lX56q-0005vl-Pt for new-work@ietf.org; Thu, 15 Apr 2021 16:44:53 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <9277ed2a-4710-dd01-4b20-b8586ec850f4@w3.org> Date: Fri, 16 Apr 2021 00:44:49 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:78.0) Gecko/20100101 Thunderbird/78.9.0 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Sat, 17 Apr 2021 17:15:30 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Accessible Platform Architectures Working Group (until 2021-05-14/15) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 15 Apr 2021 16:45:02 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBBY2Nlc3Np YmxlIFBsYXRmb3JtIEFyY2hpdGVjdHVyZXMgCldvcmtpbmcgR3JvdXA6CiDCoCBodHRwczovL3d3 dy53My5vcmcvMjAyMS8wNC9kcmFmdC1hcGEtY2hhcnRlcgoKQXMgcGFydCBvZiBlbnN1cmluZyB0 aGF0IHRoZSBjb21tdW5pdHkgaXMgYXdhcmUgb2YgcHJvcG9zZWQgd29yawphdCBXM0MsIHRoaXMg ZHJhZnQgY2hhcnRlciBpcyBwdWJsaWMgZHVyaW5nIHRoZSBBZHZpc29yeQpDb21taXR0ZWUgcmV2 aWV3IHBlcmlvZC4KClczQyBpbnZpdGVzIHB1YmxpYyBjb21tZW50cyB0aHJvdWdoIDAzOjU5IFVU QyBvbiAyMDIxLTA1LTE1CigyMzo1OSwgQm9zdG9uIHRpbWUgb24gMjAyMS0wNS0xNCkgb24gdGhl IHByb3Bvc2VkIGNoYXJ0ZXIuClBsZWFzZSBzZW5kIGNvbW1lbnRzIHRvIHB1YmxpYy1uZXctd29y a0B3My5vcmcsCndoaWNoIGhhcyBhIHB1YmxpYyBhcmNoaXZlOgogwqAgaHR0cDovL2xpc3RzLncz Lm9yZy9BcmNoaXZlcy9QdWJsaWMvcHVibGljLW5ldy13b3JrLwoKT3RoZXIgdGhhbiBjb21tZW50 cyBzZW50IGluIGZvcm1hbCByZXNwb25zZXMgYnkgVzNDIEFkdmlzb3J5CkNvbW1pdHRlZSBSZXBy ZXNlbnRhdGl2ZXMsIFczQyBjYW5ub3QgZ3VhcmFudGVlIGEgcmVzcG9uc2UgdG8KY29tbWVudHMu IElmIHlvdSB3b3JrIGZvciBhIFczQyBNZW1iZXIgWzFdLCBwbGVhc2UgY29vcmRpbmF0ZQp5b3Vy IGNvbW1lbnRzIHdpdGggeW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUuIEZv cgpleGFtcGxlLCB5b3UgbWF5IHdpc2ggdG8gbWFrZSBwdWJsaWMgY29tbWVudHMgdmlhIHRoaXMg bGlzdCBhbmQKaGF2ZSB5b3VyIEFkdmlzb3J5IENvbW1pdHRlZSBSZXByZXNlbnRhdGl2ZSByZWZl ciB0byBpdCBmcm9tIGhpcwpvciBoZXIgZm9ybWFsIHJldmlldyBjb21tZW50cy4KCklmIHlvdSBz aG91bGQgaGF2ZSBhbnkgcXVlc3Rpb25zIG9yIG5lZWQgZnVydGhlciBpbmZvcm1hdGlvbiwgcGxl YXNlCmNvbnRhY3QgTWljaGFlbCBDb29wZXIsIEFjY2Vzc2libGUgUGxhdGZvcm0gQXJjaGl0ZWN0 dXJlcyBXb3JraW5nIEdyb3VwClRlYW0gQ29udGFjdCA8Y29vcGVyQHczLm9yZz4uCgpUaGFuayB5 b3UsCgpYdWV5dWFuIEppYSwgVzNDIE1hcmtldGluZyAmIENvbW11bmljYXRpb25zCgpbMV0gaHR0 cDovL3d3dy53My5vcmcvQ29uc29ydGl1bS9NZW1iZXIvTGlzdAoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KbmV3LXdvcmsgbWFpbGluZyBsaXN0Cm5ldy13 b3JrQGlldGYub3JnCmh0dHBzOi8vd3d3LmlldGYub3JnL21haWxtYW4vbGlzdGluZm8vbmV3LXdv cmsK From nobody Wed Apr 21 12:58:44 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 6FCF83A349F; Wed, 21 Apr 2021 12:58:35 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Loganaden Velvindron via Datatracker To: Cc: babel@ietf.org, draft-ietf-babel-yang-model.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161903511538.9669.14677003191884300057@ietfa.amsl.com> Reply-To: Loganaden Velvindron Date: Wed, 21 Apr 2021 12:58:35 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-babel-yang-model-09 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Apr 2021 19:58:36 -0000 Reviewer: Loganaden Velvindron Review result: Ready I have reviewed this draft as part of SECDIR. Please treat my comments as any other comment. The draft has good security recommendations and should proceed. From nobody Thu Apr 22 07:21:28 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 43E193A0E1F for ; Thu, 22 Apr 2021 07:21:27 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <161910128670.2752.13907916776832089335@ietfa.amsl.com> Date: Thu, 22 Apr 2021 07:21:27 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Apr 2021 14:21:27 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2021-04-22 Reviewer LC end Draft Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Carl Wallace R2020-08-26 draft-ietf-stir-cert-delegation For telechat 2021-05-06 Reviewer LC end Draft Russ Mundy 2021-04-20 draft-ietf-dprive-xfr-over-tls Last calls: Reviewer LC end Draft John Bradley 2021-03-16 draft-ietf-idr-bgp-ls-registry Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Franke 2021-03-28 draft-ietf-tls-dtls-connection-id Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Phillip Hallam-Baker 2019-12-13 draft-ietf-ace-oauth-authz Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Leif Johansson None draft-ietf-netconf-crypto-types Aanchal Malhotra None draft-ietf-opsawg-l3sm-l3nm Catherine Meadows 2021-04-14 draft-ietf-ntp-interleaved-modes Daniel Migault 2021-04-29 draft-ietf-bess-datacenter-gateway Kathleen Moriarty 2021-04-27 draft-ietf-bess-mvpn-msdp-sa-interoperation Russ Mundy 2021-04-20 draft-ietf-dprive-xfr-over-tls Sandra Murphy 2020-10-15 draft-ietf-tls-external-psk-importer Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Yoav Nir 2021-04-28 draft-ietf-core-new-block Magnus Nystrom 2021-05-05 draft-ietf-idr-bgp-flowspec-oid Tirumaleswar Reddy.K 2021-05-04 draft-ietf-dnsop-nsec-ttl Kyle Rose 2021-05-04 draft-ietf-opsawg-finding-geofeeds Joseph Salowey 2021-05-03 draft-ietf-core-senml-versions Rich Salz 2021-05-03 draft-ietf-avtcore-multi-party-rtt-mix Stefan Santesson 2021-05-03 draft-ietf-netmod-geo-location Carl Wallace R2021-02-22 draft-ietf-tcpm-2140bis Carl Wallace R2020-08-26 draft-ietf-stir-cert-delegation Samuel Weiler 2021-02-22 draft-ietf-tls-dtls13 Brian Weis 2021-02-19 draft-ietf-lamps-cms-aes-gmac-alg Klaas Wierenga 2020-12-02 draft-ietf-core-echo-request-tag Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model Liang Xia 2021-03-17 draft-ietf-core-sid Early review requests: Reviewer Due Draft Tina Tsou 2021-02-15 draft-ietf-idr-eag-distribution Paul Wouters 2021-02-19 draft-ietf-idr-bgp-ls-app-specific-attr Dacheng Zhang 2020-12-07 draft-ietf-idr-eag-distribution Next in the reviewer rotation: Yaron Sheffer Rifaat Shekh-Yusef Melinda Shore Valery Smyslov Robert Sparks Takeshi Takahashi Tina Tsou Sean Turner Loganaden Velvindron Mališa Vučinić From nobody Thu Apr 22 08:37:02 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 13A0D3A14B9; Thu, 22 Apr 2021 08:36:56 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Daniel Franke via Datatracker To: Cc: draft-ietf-tls-dtls-connection-id.all@ietf.org, last-call@ietf.org, tls@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161910581603.10398.13918665853904033223@ietfa.amsl.com> Reply-To: Daniel Franke Date: Thu, 22 Apr 2021 08:36:56 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-tls-dtls-connection-id-11 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 22 Apr 2021 15:36:56 -0000 Reviewer: Daniel Franke Review result: Ready I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. Apologies for the absolute last-minute review; I overlooked until just now that this had been assigned a telechat date. This document is Ready. I do have some concerns — in particular I think relying on application-layer measures to prevent amplified reflection attacks is a bit dubious — but these have been debated to death already, the issues are well-captured in the document, and I don't think I have anything new to add. From nobody Sun Apr 25 20:30:40 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 097373A0DF6; Fri, 23 Apr 2021 07:33:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1619188380; bh=4tYiHGFAatZpR0+f4SN/NRWmOknXECPFePEPDF4NEWo=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=TUHkcW9LYbzL1JHopQcjqKqO4zYBCmbqUhNeJC8UxM2uQFXbWHEVN31MFqVnIHFXl OKCT+ocmCeXLrlbZgDAXR4LFd6AEaoWThvmHNF8zbHpX/9yp3164xye+JpcXCIUrFH I/u0e9Tu+sgcuFWRoDuZ/GakIZagwcQ8NeRL+BIw= X-Mailbox-Line: From new-work-bounces@ietf.org Fri Apr 23 07:32:54 2021 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 4D9143A0E43; Fri, 23 Apr 2021 07:32:54 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1619188374; bh=4tYiHGFAatZpR0+f4SN/NRWmOknXECPFePEPDF4NEWo=; h=From:To:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe:Reply-To; b=iiZMGFsfaNwJDZQ3A/S6gvUlEOK7UfqJWo90X2+CSvjoGZPm8YMYrdvG8bdwRo5sr NVs2SKACWYz1vq3NgV2+6814sExlxzRTulIhohtqdfrrnoAncEdBMf0Q05rU84y5Aw 3sWAPpQJ6V11MTnpBk+DVrpdb3ydDa/DRsom4xvw= X-Original-To: new-work@ietf.org Delivered-To: new-work@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 050253A0DE7 for ; Fri, 23 Apr 2021 07:32:48 -0700 (PDT) MIME-Version: 1.0 From: The IESG To: X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk MIME-Version: 1.0 Reply_to: Message-ID: <161918836800.7390.6996403788262551415@ietfa.amsl.com> Date: Fri, 23 Apr 2021 07:32:48 -0700 Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Reply-To: iesg@ietf.org Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Sun, 25 Apr 2021 20:30:39 -0700 Subject: [secdir] [new-work] WG Review: Effective Terminology in IETF Documents (term) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Apr 2021 14:33:03 -0000 A new IETF WG has been proposed in the General Area. The IESG has not made any determination yet. The following draft charter was submitted, and is provided for informational purposes only. Please send your comments to the IESG mailing list (iesg@ietf.org) by 2021-05-03. Effective Terminology in IETF Documents (term) ----------------------------------------------------------------------- Current status: Proposed WG Chairs: TBD Assigned Area Director: Lars Eggert General Area Directors: Lars Eggert Mailing list: Address: terminology@ietf.org To subscribe: https://www.ietf.org/mailman/listinfo/terminology Archive: https://mailarchive.ietf.org/arch/browse/terminology/ Group page: https://datatracker.ietf.org/group/term/ Charter: https://datatracker.ietf.org/doc/charter-ietf-term/ The mission of the IETF as specified in BCP 95 is to produce high quality, relevant technical documents that influence the way people design, use, and manage the Internet. Contributions to the IETF, including Internet-Drafts and RFCs, are most understandable and effective when they use terminology that is clear, precise, and widely accessible to readers from varying backgrounds and cultures. This maximizes the benefits the IETF derives from its central principles, such as its open process and volunteer core. In the years leading up to the chartering of this working group, there has been discussion in the IETF, in other standards organizations, and in the broader technology industry about the use of certain terms of art in technical writing and whether those and other terms have an exclusionary effect. While opinions vary among IETF participants about this topic, there is widespread agreement that the IETF community would benefit from advice about using effective terminology that would improve clarity and approachability. The TERM working group is therefore chartered to produce an Informational RFC containing guidance to IETF participants on the use of effective terminology that also minimizes exclusionary effects. The RFC will express general principles for assessing when language is effective. The principles should be derived considering input from a broad set of IETF participants. The WG will identify and recommend external, independently updated resources containing examples of potentially problematic terms and potential alternatives to IETF participants for their consideration, to align its efforts with broader activities by the technology industry. The TERM working group is a focused group aiming to produce a single deliverable. It is designed to complement other efforts at fostering inclusivity in the IETF and will liaise with appropriate external groups, such as other SDOs or industry initiatives, to coordinate. The output of this WG will provide guidance to IETF participants and will not restrict the type or content of contributions that can be made to the IETF standards process. The output of this WG may inform a potential future activity by the RFC Editor to establish terminology guidance for the overall RFC series, but does not constrain any such future action. Milestones: Jun 2021 - Adopt draft providing informational terminology recommendations Dec 2021 - Submit informational terminology recommendations to IESG _______________________________________________ new-work mailing list new-work@ietf.org https://www.ietf.org/mailman/listinfo/new-work From nobody Tue Apr 27 09:24:57 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 1C2FD3A15B6; Tue, 27 Apr 2021 09:24:48 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Daniel Migault via Datatracker To: Cc: bess@ietf.org, draft-ietf-bess-datacenter-gateway.all@ietf.org, last-call@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161954068804.26944.17229787113752757407@ietfa.amsl.com> Reply-To: Daniel Migault Date: Tue, 27 Apr 2021 09:24:48 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-bess-datacenter-gateway-10 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 27 Apr 2021 16:24:48 -0000 Reviewer: Daniel Migault Review result: Ready Hi, Review result: Ready I reviewed this document as part of the Security Directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the Security Area Directors.  However, in this case these comments mostly reflect some question to clarify my own understanding. Document authors, document editors, and WG chairs should treat these comments just like any other IETF Last Call comments. Yours, Daniel Just to clarify my understanding of Fig 1. BGP usually selects the best route, so if AS1-AS2 is the best, none of the traffic will go through AS3. However even in this configuration AS2 will select one of the GW and all traffic will go only to one of the GW1 or GW2. The Add-Path might be able to distinguishes between AS1-AS2 and AS3 but AS1-AS2 cannot be subdivided between two paths one that would terminates in GW1 and another that would terminates at GW2. I am not sure following acronyms may be expanded as well as AFI/SAFI being described with text as opposed to their values. I let you decide whether that is needed or not. OLD:  An IPv4 or IPv6 NLRI containing one of the GW's loopback addresses       (that is, with an AFI/SAFI pair that is one of 1/1, 2/1, 1/4, or       2/4). NEW  An IPv4 or IPv6 Network Layer Reachability Information (NLRI) [RFC4760] containing one of the GW's loopback addresses (that is, with an Address Family Number (AFI)/ Subsequent Address Family (SAFI) pair that is one of IPv4/NLRI used for unicast forwarding (1/1), IPv6/NLRI used for unicast forwarding (2/1), IPv4/NLRI with MPLS Labels (1/4), or IPv6/NLRI with MPLS Labels (2/4)). Security consideration: When the information is shared between the domains, I am wondering if the information is encrypted or if the communication appears in clear text. If no encryption is used, that information is actually not limited to the two domains but to anyone on path can read it. If that is the case, information provided by the Egress SR domain to the Ingress SR Domain seems to me transiting through the backbone which makes the information pretty much public. I am wondering if I am missing something. From nobody Thu Apr 29 05:13:31 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 119503A3C76; Thu, 29 Apr 2021 05:13:22 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit From: Kyle Rose via Datatracker To: Cc: draft-ietf-opsawg-finding-geofeeds.all@ietf.org, last-call@ietf.org, opsawg@ietf.org X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Message-ID: <161969840202.30267.8231145700644479792@ietfa.amsl.com> Reply-To: Kyle Rose Date: Thu, 29 Apr 2021 05:13:22 -0700 Archived-At: Subject: [secdir] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2021 12:13:22 -0000 Reviewer: Kyle Rose Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document Has Issues. == Nits The nits include a need for a thorough editorial pass prior to submission to the RFC editor. For example: * The abstract should probably give the uninformed reader a bit more information about the overall geofeed ecosystem. * "utterly awesome", "or whatever", "It would be polite" I would also move the privacy discussion from section 2 "Geofeed Files" to a privacy considerations section, as that is where those concerned will look for that information. == Unclear requirements This document appears to propose overlapping mechanisms for establishment of trust in geofeed data. As far as I can tell, geofeed data may be authenticated both by: * RPKI private key signature of a digest of a canonicalized form of the geofeed data file. * Web PKI via https URL for geofeed data file. I'm trying to suss out the requirements that led to this design, and so far it is not clear to me why two mechanisms are necessary or desirable given the complexity this implies for clients. ISTM that if a requirement is made that the geofeed data file MUST be served via https, and RPKI authenticates the URL, then the web PKI would provide a sufficient trust anchor for the geofeed data itself without any additional RPKI signature. Alternatively, if the assumption is that RPKI is the more appropriate PKI for protecting this information, then why leverage the web PKI at all? Moreover, even if the flexibility offered by two mechanisms is found to be desirable, there is no explicit recommendation that an LIR use one mechanism exclusively for a given geofeed. == Security gaps * There appears to be no way to revoke previously-signed geofeed data except via rotation of the RPKI key pair. Using the web PKI and https is a countermeasure here by preventing impersonation of the geofeed host, but it's unclear what utility RPKI provides if web PKI is required to guarantee geofeed freshness. Metadata imposing a expiry on geofeed data authenticated by RPKI would serve the same function, at the cost of requiring the data to be refreshed regularly. == Other questions * Is it always the case that RPKI private keys are protected by HSM, or is that simply a best practice? Is the assumption that all RPKI changes imply a manual workflow? * Is it actually the case that "the data change very infrequently"? Is there no legitimate use case for rapidly changing geofeed information, e.g., for overlay networks providing IP mobility? 'At most weekly' seems arbitrary. This also has implications for the choice of PKI, if manual workflows are indeed required for RPKI signing. * Why does the geofeed appendix not accommodate multiple signatures for distinct address ranges? The requirement that a geofeed file not be RPKI-signed in order to be shared by multiple INETNUM objects could be relieved were multiple signatures allowed. From nobody Thu Apr 29 07:21:24 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 268823A3F12; Thu, 29 Apr 2021 06:38:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1619703532; bh=Dt94+kt79w6FL6P/mO+BgE5w69BB8iuqI/N/BuY3Uws=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=Pnl4J/dPAwTTF33IPrtm35PEBUlCQplZLyI942AIzksobCMcX5L/2VFZjXgdESQvA CSmFBSEJVXP4GJav6mKF3XjN4jx63MSjmatYVtpP4k+XJpFRlfW4tIdtDkEALHmvPd EBzd6MCHMGxFztkVzBfkHlizTcygpaZjGcbOfomY= X-Mailbox-Line: From new-work-bounces@ietf.org Thu Apr 29 06:38:51 2021 Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 64EC83A3F0C; Thu, 29 Apr 2021 06:38:51 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=ietf.org; s=ietf1; t=1619703531; bh=Dt94+kt79w6FL6P/mO+BgE5w69BB8iuqI/N/BuY3Uws=; h=To:From:Date:Subject:List-Id:List-Unsubscribe:List-Archive: List-Post:List-Help:List-Subscribe; b=MKyI7S8T56MzL4Sj0HLKw4wl8toLUNLtZxG/pwmXDxHE7kQpFlJvknNKi6e+FBg8n haCBFwPjWNtUOhSu6hqVDXyJfs9zDMiCoa7sKGR95ujq6ivvJCkEBhm29u/PKUaVPH Gl7TkGLsTT2QkFUOmSKxbGV3puS0m6BFF3728/+E= X-Original-To: new-work@ietfa.amsl.com Delivered-To: new-work@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 39D933A3F0C for ; Thu, 29 Apr 2021 06:38:50 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -0.9 X-Spam-Level: X-Spam-Status: No, score=-0.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.999, RCVD_IN_DNSWL_BLOCKED=0.001, SPF_PASS=-0.001] autolearn=no autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id w3QA7yNqFzWS for ; Thu, 29 Apr 2021 06:38:47 -0700 (PDT) Received: from raoul.w3.org (raoul.w3.org [128.30.52.128]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 63D393A3F09 for ; Thu, 29 Apr 2021 06:38:47 -0700 (PDT) Received: from [45.145.248.64] (helo=jiaxueyuandeMacBook-Pro.local) by raoul.w3.org with esmtpsa (TLS1.3:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.92) (envelope-from ) id 1lc6sP-0001T4-Hl for new-work@ietf.org; Thu, 29 Apr 2021 13:38:46 +0000 To: new-work@ietf.org From: xueyuan Message-ID: <3fbbd25a-9611-ce2a-5213-464f9786207e@w3.org> Date: Thu, 29 Apr 2021 21:38:41 +0800 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:78.0) Gecko/20100101 Thunderbird/78.9.1 MIME-Version: 1.0 Content-Language: en-US Archived-At: X-BeenThere: new-work@ietf.org X-Mailman-Version: 2.1.29 Precedence: list Content-Transfer-Encoding: base64 Content-Type: text/plain; charset="utf-8"; Format="flowed" Errors-To: new-work-bounces@ietf.org Sender: "new-work" Archived-At: X-Mailman-Approved-At: Thu, 29 Apr 2021 07:21:23 -0700 Subject: [secdir] [new-work] Proposed W3C Charter: Media & Entertainment Interest Group (until 2021-05-28/29) X-BeenThere: secdir@ietf.org List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2021 13:38:54 -0000 SGVsbG8sCgpUb2RheSBXM0MgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlcyByZWNl aXZlZCBhIFByb3Bvc2FsCnRvIHJldmlldyBhIGRyYWZ0IGNoYXJ0ZXIgZm9yIHRoZSBNZWRpYSAm IEVudGVydGFpbm1lbnQgSW50ZXJlc3QgR3JvdXA6CiDCoCBodHRwczovL3d3dy53My5vcmcvMjAy MS8wNC9tZWlnLWNoYXJ0ZXIuaHRtbAoKQXMgcGFydCBvZiBlbnN1cmluZyB0aGF0IHRoZSBjb21t dW5pdHkgaXMgYXdhcmUgb2YgcHJvcG9zZWQgd29yawphdCBXM0MsIHRoaXMgZHJhZnQgY2hhcnRl ciBpcyBwdWJsaWMgZHVyaW5nIHRoZSBBZHZpc29yeQpDb21taXR0ZWUgcmV2aWV3IHBlcmlvZC4K ClczQyBpbnZpdGVzIHB1YmxpYyBjb21tZW50cyB0aHJvdWdoIDAzOjU5IFVUQyBvbiAyOSBNYXkg MjAyMQooMjM6NTksIEVhc3Rlcm4gdGltZSBvbiAyOCBNYXkpIG9uIHRoZSBwcm9wb3NlZCBjaGFy dGVyLgpQbGVhc2Ugc2VuZCBjb21tZW50cyB0byBwdWJsaWMtbmV3LXdvcmtAdzMub3JnLAp3aGlj aCBoYXMgYSBwdWJsaWMgYXJjaGl2ZToKIMKgIGh0dHA6Ly9saXN0cy53My5vcmcvQXJjaGl2ZXMv UHVibGljL3B1YmxpYy1uZXctd29yay8KCk90aGVyIHRoYW4gY29tbWVudHMgc2VudCBpbiBmb3Jt YWwgcmVzcG9uc2VzIGJ5IFczQyBBZHZpc29yeQpDb21taXR0ZWUgUmVwcmVzZW50YXRpdmVzLCBX M0MgY2Fubm90IGd1YXJhbnRlZSBhIHJlc3BvbnNlIHRvCmNvbW1lbnRzLiBJZiB5b3Ugd29yayBm b3IgYSBXM0MgTWVtYmVyIFsxXSwgcGxlYXNlIGNvb3JkaW5hdGUKeW91ciBjb21tZW50cyB3aXRo IHlvdXIgQWR2aXNvcnkgQ29tbWl0dGVlIFJlcHJlc2VudGF0aXZlLiBGb3IKZXhhbXBsZSwgeW91 IG1heSB3aXNoIHRvIG1ha2UgcHVibGljIGNvbW1lbnRzIHZpYSB0aGlzIGxpc3QgYW5kCmhhdmUg eW91ciBBZHZpc29yeSBDb21taXR0ZWUgUmVwcmVzZW50YXRpdmUgcmVmZXIgdG8gaXQgZnJvbSBo aXMKb3IgaGVyIGZvcm1hbCByZXZpZXcgY29tbWVudHMuCgpUaGUgZ3JvdXAncyBjdXJyZW50IGNo YXJ0ZXIgaXMgZXh0ZW5kZWQgdW50aWwgMzEgTWF5IHRvIGFjY29tbW9kYXRlCnRoZSBjaGFydGVy IHJldmlldyBwZXJpb2Q6Cmh0dHBzOi8vd3d3LnczLm9yZy8yMDE5LzA2L21lLWlnLWNoYXJ0ZXIu aHRtbAoKSWYgeW91IHNob3VsZCBoYXZlIGFueSBxdWVzdGlvbnMgb3IgbmVlZCBmdXJ0aGVyIGlu Zm9ybWF0aW9uLCBwbGVhc2UKY29udGFjdCBLYXp1eXVraSBBc2hpbXVyYSwgVGVhbSBDb250YWN0 IGZvciB0aGUgTWVkaWEgJiBFbnRlcnRhaW5tZW50CkludGVyZXN0IEdyb3VwLCBhdCA8YXNoaW11 cmFAdzMub3JnPi4KClRoYW5rIHlvdSwKClh1ZXl1YW4gSmlhLMKgIFczQyBNYXJrZXRpbmcgJiBD b21tdW5pY2F0aW9ucwoKWzFdIGh0dHA6Ly93d3cudzMub3JnL0NvbnNvcnRpdW0vTWVtYmVyL0xp c3QKCl9fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fCm5ldy13 b3JrIG1haWxpbmcgbGlzdApuZXctd29ya0BpZXRmLm9yZwpodHRwczovL3d3dy5pZXRmLm9yZy9t YWlsbWFuL2xpc3RpbmZvL25ldy13b3JrCg== From nobody Thu Apr 29 12:56:43 2021 Return-Path: X-Original-To: secdir@ietfa.amsl.com Delivered-To: secdir@ietfa.amsl.com Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id A3C873A08C0; Thu, 29 Apr 2021 12:56:37 -0700 (PDT) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -1.9 X-Spam-Level: X-Spam-Status: No, score=-1.9 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, SPF_HELO_NONE=0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no Received: from mail.ietf.org ([4.31.198.44]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4ZK7Z7H3dTTG; Thu, 29 Apr 2021 12:56:35 -0700 (PDT) Received: from ran.psg.com (ran.psg.com [IPv6:2001:418:8006::18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 2F6553A08BD; Thu, 29 Apr 2021 12:56:35 -0700 (PDT) Received: from localhost ([127.0.0.1] helo=ryuu.rg.net) by ran.psg.com with esmtp (Exim 4.90_1) (envelope-from ) id 1lcClz-0007hk-Tf; Thu, 29 Apr 2021 19:56:32 +0000 Date: Thu, 29 Apr 2021 12:56:31 -0700 Message-ID: From: Randy Bush To: Kyle Rose via Datatracker Cc: , draft-ietf-opsawg-finding-geofeeds.all@ietf.org, last-call@ietf.org, opsawg@ietf.org In-Reply-To: <161969840202.30267.8231145700644479792@ietfa.amsl.com> References: <161969840202.30267.8231145700644479792@ietfa.amsl.com> User-Agent: Wanderlust/2.15.9 (Almost Unreal) Emacs/26.3 Mule/6.0 (HANACHIRUSATO) MIME-Version: 1.0 (generated by SEMI-EPG 1.14.7 - "Harue") Content-Type: text/plain; charset=US-ASCII Archived-At: Subject: Re: [secdir] Secdir last call review of draft-ietf-opsawg-finding-geofeeds-06 X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 29 Apr 2021 19:56:38 -0000 hi kyle: thanks a million for the review. we have a suply chain problem getting solid reviews these days. > The nits include a need for a thorough editorial pass prior to submission to > the RFC editor. For example: > > * The abstract should probably give the uninformed reader a bit more > information about the overall geofeed ecosystem. * "utterly awesome", "or > whatever", "It would be polite" aha! the style directorate. we'll see how far it gets. maybe even rfced still has a twinkle in their eye. :) > I would also move the privacy discussion from section 2 "Geofeed > Files" to a privacy considerations section, as that is where those > concerned will look for that information. aha. a privacy section is a new fashion of which i was unaware. done. thanks. > This document appears to propose overlapping mechanisms for > establishment of trust in geofeed data. As far as I can tell, geofeed > data may be authenticated both by: > > * RPKI private key signature of a digest of a canonicalized form of the > geofeed data file. * Web PKI via https URL for geofeed data file. not exactly. the web pki has no authority over IP address space ownership. it is only used to authenticate a *pointer* to the geofeed file. and the S in https is just because we know folk will whine if the S is not there; it's ietf fashion, similar to not working over ipv6 (or privacy consideration sections:). And the us of TLS will ensure that the file comes from the intended source and it comes without modification. for example, was i to put my geofeed file in gobble docs, the web pki would be gobble's cert chain, not mine, the IP space owner. one can optionally authenticate the geofeed data themselves by using the rpki to sign over them. and, unlike the web pki, the rpki does provide authority over IP address space ownership. so these two pki uses are quite distinct and serve very different purposes. to aid the reader, i have hacked in The URL's use of the web PKI can not provide authentication of IP address space ownership. It is only used to authenticate a pointer to the geofeed file and transport integrity of the data. In contrast, the RPKI can be used to authenticate IP space ownership; see optional authentication in Section 4. > I'm trying to suss out the requirements that led to this design, and > so far it is not clear to me why two mechanisms are necessary or > desirable given the complexity this implies for clients. ISTM that if > a requirement is made that the geofeed data file MUST be served via > https, and RPKI authenticates the URL, then the web PKI would provide > a sufficient trust anchor for the geofeed data itself without any > additional RPKI signature. Alternatively, if the assumption is that > RPKI is the more appropriate PKI for protecting this information, then > why leverage the web PKI at all? see above > * There appears to be no way to revoke previously-signed geofeed data > except via rotation of the RPKI key pair. Using the web PKI and https > is a countermeasure here by preventing impersonation of the geofeed > host, but it's unclear what utility RPKI provides if web PKI is > required to guarantee geofeed freshness. Metadata imposing a expiry > on geofeed data authenticated by RPKI would serve the same function, > at the cost of requiring the data to be refreshed regularly. validation of the signing certificate needs to ensure that it is part of the current manifest and that the resources are covered by the RPKI certificate. this handles revocation. but, if you want to go down the "how does revocation work in the rpki" rabbit hole, you have to drink the 3779 validation koolaid, and that of the "up-down" protocol, and have a look at manifests. not that i am recommending going down this rabbit hole. > * Is it always the case that RPKI private keys are protected by HSM, > or is that simply a best practice? not at all. but, imiho, we should stay neutral on that. the example Identifying the private key associated with the certificate, and getting the department with the Hardware Security Module (HSM) to sign the CMS blob is left as an exercise for the implementor. was merely a cultural reference to the silos in a large LIR where address space ownership, rpki signing, ... are often in a very separate fiefdom from geo location folk. > Is the assumption that all RPKI changes imply a manual workflow? no. one hopes it will become more and more automated as time passes. we hope the manual workflow will go away. weekly would be a fantastic improvement over the multi-month or forever gap we have now. every week there is a plea on nanog "my customer in gzork is blocked by fooTV who seems to think thay're in gzplatz and won't let them watch sesame street." the two informative references, draft-ietf-sidrops-rpki-rta and draft-spaghetti-sidrops-rpki-rsc, should give you a feeling to where this can go, devops willing. > * Is it actually the case that "the data change very infrequently"? > Is there no legitimate use case for rapidly changing geofeed > information, e.g., for overlay networks providing IP mobility? 'At > most weekly' seems arbitrary. This also has implications for the > choice of PKI, if manual workflows are indeed required for RPKI > signing. hmmmm. on the one hand, UpTightInternetTV really just wants to know geoloc of cable customers; and today this takes weeks, months, or never. on the other hand, i can see ietf folk wondering about extensibility and future uses. on the third hand, do we really want to wrap ourselves around the axle of geolocating LEO satellites? but the bit you quote is in advice to the entity *fetching* geofeed data. if they are trying to geolocate LEO satellites which wish to be geolocated with high time resolution, they should use the cache headers. Note that it does say Section 3.4 suggests use of the [RFC7234] HTTP Expires Caching Header to signal when geofeed data should be refetched. As the data change very infrequently, in the absence of such an HTTP Header signal, collectors MUST NOT fetch more frequently than weekly. the ops style hack we would use is to change the collectors MUST NOT fetch more frequently to collectors SHOULD NOT fetch more frequently > * Why does the geofeed appendix not accommodate multiple signatures > for distinct address ranges? The requirement that a geofeed file not > be RPKI-signed in order to be shared by multiple INETNUM objects > could be relieved were multiple signatures allowed. do we really want to start work on RFC5485-bis? but maybe russ has better thoughts on this than i. unless told otherwise, i'll hold -07 for a few more reviews. again, thanks. randy From nobody Fri Apr 30 04:48:45 2021 Return-Path: X-Original-To: secdir@ietf.org Delivered-To: secdir@ietfa.amsl.com Received: from ietfa.amsl.com (localhost [IPv6:::1]) by ietfa.amsl.com (Postfix) with ESMTP id 9059E3A1266 for ; Fri, 30 Apr 2021 04:48:44 -0700 (PDT) MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit From: Tero Kivinen via Datatracker To: X-Test-IDTracker: no X-IETF-IDTracker: 7.28.0 Auto-Submitted: auto-generated Precedence: bulk Reply-To: secdir-secretary@mit.edu, Tero Kivinen Message-ID: <161978332456.6885.652841625983230060@ietfa.amsl.com> Date: Fri, 30 Apr 2021 04:48:44 -0700 Archived-At: Subject: [secdir] Assignments X-BeenThere: secdir@ietf.org X-Mailman-Version: 2.1.29 List-Id: Security Area Directorate List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 30 Apr 2021 11:48:45 -0000 Review instructions and related resources are at: http://tools.ietf.org/area/sec/trac/wiki/SecDirReview For telechat 2021-05-06 Reviewer LC end Draft Russ Mundy 2021-04-20 draft-ietf-dprive-xfr-over-tls Yoav Nir 2021-04-28 draft-ietf-core-new-block Last calls: Reviewer LC end Draft John Bradley 2021-03-16 draft-ietf-idr-bgp-ls-registry Shaun Cooley 2021-02-25 draft-ietf-v6ops-ipv6-ehs-packet-drops Alan DeKok 2021-03-24 draft-ietf-cbor-tags-oid Daniel Gillmor 2021-03-26 draft-ietf-lamps-crmf-update-algs Phillip Hallam-Baker 2019-12-13 draft-ietf-ace-oauth-authz Steve Hanna 2021-03-22 draft-ietf-regext-secure-authinfo-transfer Leif Johansson None draft-ietf-netconf-crypto-types Aanchal Malhotra None draft-ietf-opsawg-l3sm-l3nm Catherine Meadows 2021-04-14 draft-ietf-ntp-interleaved-modes Kathleen Moriarty 2021-04-27 draft-ietf-bess-mvpn-msdp-sa-interoperation Russ Mundy 2021-04-20 draft-ietf-dprive-xfr-over-tls Sandra Murphy R2021-04-05 draft-ietf-dmarc-psd Sandra Murphy 2020-10-15 draft-ietf-tls-external-psk-importer Yoav Nir 2021-04-28 draft-ietf-core-new-block Magnus Nystrom 2021-05-05 draft-ietf-idr-bgp-flowspec-oid Tirumaleswar Reddy.K 2021-05-04 draft-ietf-dnsop-nsec-ttl Joseph Salowey 2021-05-03 draft-ietf-core-senml-versions Rich Salz 2021-05-03 draft-ietf-avtcore-multi-party-rtt-mix Stefan Santesson 2021-05-03 draft-ietf-netmod-geo-location Yaron Sheffer 2021-05-07 draft-ietf-lsr-isis-srv6-extensions Carl Wallace R2020-08-26 draft-ietf-stir-cert-delegation Carl Wallace R2021-02-22 draft-ietf-tcpm-2140bis Samuel Weiler 2021-02-22 draft-ietf-tls-dtls13 Brian Weis 2021-02-19 draft-ietf-lamps-cms-aes-gmac-alg Klaas Wierenga 2020-12-02 draft-ietf-core-echo-request-tag Klaas Wierenga 2020-05-26 draft-ietf-kitten-krb-spake-preauth Paul Wouters 2020-09-08 draft-ietf-i2nsf-capability-data-model Liang Xia 2021-03-17 draft-ietf-core-sid Early review requests: Reviewer Due Draft Tina Tsou 2021-02-15 draft-ietf-idr-eag-distribution Paul Wouters 2021-02-19 draft-ietf-idr-bgp-ls-app-specific-attr Dacheng Zhang 2020-12-07 draft-ietf-idr-eag-distribution Next in the reviewer rotation: Rifaat Shekh-Yusef Melinda Shore Valery Smyslov Robert Sparks Tina Tsou Sean Turner Loganaden Velvindron Mališa Vučinić Carl Wallace Samuel Weiler