Hi All,
I have completed my AD Evaluation of
draft-ietf-tictoc-security-requirements as a part of the publication
process. I found this document well-written and easy to read. I have a
few comments/questions that I would like to see resolved before moving
this document to IETF Last Call. Please let me know if you have any
questions/comments/concerns about these points...Introduction ------------ * It would be useful to explain what is meant by an "inherent security protocol" with respect to RFC 5905. * Please explain why PTP is included in these requirements even though it is not an IETF standard. This will eliminate a variety of questions come IESG Evaluation. Section 3.1.1 ------------- * I think it would be useful to clarify the relationship between the internal attacks and Byzantine attacks in this context. Section 3.2.7 ------------- * Provide a few informative references to these types of attacks. Section 3.2.8 ------------- * There is a missing "." at the end of the section. Section 3.3 ----------- * Can you explain in what situations a False Time would not also be an Accuracy Degradation? Section 5 --------- * I think it may be worth mentioning when a requirement can be met by an existing protocol/practice/technique. Given the dependency on time information for most security protocols, existence proofs would be useful. Section 5.6.2 ------------- * Does this requirement apply equally to clocks at different levels of the hierarchy? For example, the association between a Stratum 2 clock and a Stratum 3 clock in NTP may have different characteristics than an association between two clocks at the same stratum level. Section 5.10.2 -------------- * The MAY seems too weak. It makes the support of a solution completely optional. How will operators ever transition to a secure mode if vendors ignore the MAY? Regards, Brian
signature.asc
Description: OpenPGP digital signature
_______________________________________________ TICTOC mailing list [email protected] https://www.ietf.org/mailman/listinfo/tictoc
