Subject: Re: [ippm] Secdir review of draft-ietf-ippm-owamp-registry-03

From: "MORTON, ALFRED C (AL)" <[email-masked]>
Date: Thu, 17 Sep 2015 10:02:49 -0400

Hi Alan,
thanks for your review, please see replies below.
FWIW - I had to look-up the details.
Al

> -----Original Message-----
> From: Alan DeKok [mailto:[email-masked]]
> Sent: Wednesday, September 16, 2015 2:03 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Secdir review of draft-ietf-ippm-owamp-registry-03
> 
> I have reviewed this document as part of the security directorate's
> ongoing effort to review all IETF documents being processed by the IESG.
> These comments were written primarily for the benefit of the security
> area directors.  Document editors and WG chairs should treat these
> comments just like any other last call comments.
> 
>   This document requests IANA allocation of registries for OWAMP.   As
> such, it has minimal security impact.
> 
>   One practical note is the request to assign an "Experimentation"
> OWAMP-Control Command Number.  Experience shows that such numbers are
> either never used, or used as experiments... which then get widely
> deployed before standards action catches up to practical needs.

[ACM] 
I understand how this might happen, but IETF already has a 
BCP that covers this topic: https://tools.ietf.org/html/bcp82

> 
>   It may be good to add some discussion as to *how* experiments are
> done, and how experiments can transition from the "Experimentation"
> number to a standard number.

[ACM] 
IMO, BCP82 covers this aspect adequately. 

> 
>   One suggestion would be to change the label from "Experimentation" to
> "Site-Local".  That would still allow sites to experiment with OWAMP-
> Control commands, but would make it clearer that such experimentation is
> only for the local site, and MUST NOT be used in a  wider context.

[ACM] 
Site-local is not a valid registry assignment, see:
https://tools.ietf.org/html/rfc5226#section-4
Also, I would expect that an Internet performance characterization
protocol will be deployed on the Internet when using an experimental command
to conduct experiments, so not Site-Local.

Note that the existing reference to RFC5226 makes a clear reference to
BCP 82 in section 4.