As required by RFC 4858, this is the current template for the Document
Shepherd Write-Up.
Changes are expected over time. This version is dated 24 February 2012.
(1) What type of RFC is being requested (BCP, Proposed Standard, Internet
Standard, Informational, Experimental, or Historic)? Why is this the proper
type of RFC? Is this type of RFC indicated in the title page header?
<response to (1)>
i) Type of RFC Requested: Informational
ii) It is the proper type of RFC because the document describes a security
threat
analysis and not a protocol
iii) The type of RFC is indicated in the title page header
</response to (1)>
(2) The IESG approval announcement includes a Document Announcement Write-Up.
Please provide such a Document Announcement Write-Up. Recent examples can be
found in the "Action" announcements for approved documents. The approval
announcement contains the following sections:
Technical Summary:
Relevant content can frequently be found in the abstract and/or introduction of
the document. If not, this may be an indication that there are deficiencies in
the abstract or introduction.
<response to (2) Technical Summary>
The document presents a security threat analysis for the Routing Protocol for
Low- power and lossy networks (RPL, ROLL). The development builds upon
previous work on routing security and adapts the assessments to the issues and
constraints specific to low-power and lossy networks. A systematic approach is
used in defining and evaluating the security threats. Applicable
countermeasures are application specific and are addressed in relevant
applicability statements. </response to (2) Technical Summary>
Working Group Summary:
Was there anything in WG process that is worth noting? For example, was there
controversy about particular points or were there decisions where the consensus
was particularly rough?
<response to (2) Working Group Summary>
This document is based upon draft-ietf-roll-security-framework. It was agreed to
produce a new document in line with the ROLL WG work item:
Sep 2012: Submit first draft of RPL threat analysis to the IESG to be
considered as an Informational RFC
The goal of this document is to outline threats with the expectation that
applicability statements will have to cover (i.e. mitigate or solve) these
threats in some way. </response to (2) Working Group Summary>
Document Quality:
Are there existing implementations of the protocol? Have a significant number of
vendors indicated their plan to implement the specification? Are there any
reviewers that merit special mention as having done a thorough review, e.g.,
one that resulted in important changes or a conclusion that the document had no
substantive issues? If there was a MIB Doctor, Media Type or other expert
review, what was its course (briefly)? In the case of a Media Type review, on
what date was the request posted?
<response to (2) Document Quality>
The previous document (draft-ietf-roll-security-framework) on which this
document is based has had thorough reviews by Rene Struik, JP Vasseur, Michael
Richardson and Adrian Farrel, which ultimately contributed to the re-submission
of this document.
This document has had review from Stephen Kent and Sean Turner.
</response to (2) Document Quality>
Personnel:
Who is the Document Shepherd? Who is the Responsible Area Director?
<response to (2) Personnel>
The Document Shepherd is Robert Cragie.
The Responsible Area Director is Adrian Farrel.
</response to (2) Personnel>
(3) Briefly describe the review of this document that was performed by the
Document Shepherd. If this version of the document is not ready for
publication, please explain why the document is being forwarded to the IESG.
<response to (3)>
The Document Shepherd reviewed a previous version (06) of the document and
raised some concerns which were promptly dealt with. </response to (3)>
(4) Does the document Shepherd have any concerns about the depth or breadth of
the reviews that have been performed?
<response to (4)>
The document has not had a particularly broad review relative to other working
group documents given the subject material. </response to (4)>
(5) Do portions of the document need review from a particular or from broader
perspective, e.g., security, operational complexity, AAA, DNS, DHCP, XML, or
internationalization? If so, describe the review that took place.
<response to (5)>
As the document is regarding security threats to the RPL protocol, it is
recommended that it is reviewed by the security Area Director. </response to
(5)>
(6) Describe any specific concerns or issues that the Document Shepherd has
with this document that the Responsible Area Director and/or the IESG should be
aware of? For example, perhaps he or she is uncomfortable with certain parts of
the document, or has concerns whether there really is a need for it. In any
event, if the WG has discussed those issues and has indicated that it still
wishes to advance the document, detail those concerns here.
<response to (6)>
The Document Shepherd has no concerns.
</response to (6)>
(7) Has each author confirmed that any and all appropriate IPR disclosures
required for full conformance with the provisions of BCP 78 and BCP 79 have
already been filed. If not, explain why?
<response to (7)>
The authors have confirmed that there are no IPR disclosures required for full
conformance with BCP 78 and BCP 79.
</response to (7)>
(8) Has an IPR disclosure been filed that references this document? If so,
summarize any WG discussion and conclusion regarding the IPR disclosures.
<response to (8)>
There are no IPR disclosures that reference the document.
</response to (8)>
(9) How solid is the WG consensus behind this document? Does it represent the
strong concurrence of a few individuals, with others being silent, or does the
WG as a whole understand and agree with it?
<response to (9)>
It represents the concurrence of a few individuals. Most of the WG has been
silent on this document. </response to (9)>
(10) Has anyone threatened an appeal or otherwise indicated extreme discontent?
If so, please summarise the areas of conflict in separate email messages to the
Responsible Area Director. (It should be in a separate email because this
questionnaire is publicly available.)
<response to (10)>
No.
</response to (10)>
(11) Identify any ID nits the Document Shepherd has found in this document. (See
http://www.ietf.org/tools/idnits/ and the Internet-Drafts Checklist).
Boilerplate checks are not enough; this check needs to be thorough.
<response to (11)>
idnits 2.13.00
/tmp/draft-ietf-roll-security-threats-08.txt:
Checking boilerplate required by RFC 5378 and the IETF Trust (see
http://trustee.ietf.org/license-info):
----------------------------------------------------------------------------
No issues found here.
Checking nits according to http://www.ietf.org/id-info/1id-guidelines.txt:
----------------------------------------------------------------------------
No issues found here.
Checking nits according to http://www.ietf.org/id-info/checklist :
----------------------------------------------------------------------------
No issues found here.
Miscellaneous warnings:
----------------------------------------------------------------------------
-- The document date (July 19, 2014) is 11 days in the past. Is this
intentional?
Checking references for intended status: Informational
----------------------------------------------------------------------------
== Missing Reference: 'IS07498-2' is mentioned on line 154, but not defined
== Unused Reference: 'RFC4107' is defined on line 1545, but no explicit
reference was found in the text
== Unused Reference: 'RFC4301' is defined on line 1548, but no explicit
reference was found in the text
== Unused Reference: 'FIPS197' is defined on line 1571, but no explicit
reference was found in the text
== Unused Reference: 'Huang2003' is defined on line 1575, but no explicit
reference was found in the text
== Unused Reference: 'I-D.alexander-roll-mikey-lln-key-mgmt' is defined on
line 1583, but no explicit reference was found in the text
== Unused Reference: 'IEEE1149.1' is defined on line 1600, but no explicit
reference was found in the text
== Unused Reference: 'Kasumi3gpp' is defined on line 1618, but no explicit
reference was found in the text
== Unused Reference: 'Messerges2003' is defined on line 1623, but no
explicit reference was found in the text
== Unused Reference: 'RFC2080' is defined on line 1644, but no explicit
reference was found in the text
== Unused Reference: 'RFC2453' is defined on line 1649, but no explicit
reference was found in the text
== Unused Reference: 'RFC3830' is defined on line 1655, but no explicit
reference was found in the text
== Unused Reference: 'RFC4046' is defined on line 1659, but no explicit
reference was found in the text
== Unused Reference: 'RFC5055' is defined on line 1672, but no explicit
reference was found in the text
== Unused Reference: 'RFC5197' is defined on line 1676, but no explicit
reference was found in the text
== Unused Reference: 'RFC5996' is defined on line 1700, but no explicit
reference was found in the text
== Unused Reference: 'RFC6574' is defined on line 1707, but no explicit
reference was found in the text
== Unused Reference: 'Szcze2008' is defined on line 1728, but no explicit
reference was found in the text
== Unused Reference: 'Wander2005' is defined on line 1741, but no explicit
reference was found in the text
== Outdated reference: draft-ietf-roll-terminology has been published as
RFC 7102
== Outdated reference: A later version (-06) exists of
draft-kelsey-intarea-mesh-link-establishment-05
-- Obsolete informational reference (is this intentional?): RFC 1142
(Obsoleted by RFC 7142)
Summary: 0 errors (**), 0 flaws (~~), 21 warnings (==), 2 comments (--).
</response to (11)>
(12) Describe how the document meets any required formal review criteria, such
as the MIB Doctor, media type, and URI type reviews.
<response to (12)>
No formal review required.
</response to (12)>
(13) Have all references within this document been identified as either
normative or informative?
<response to (13)>
Yes.
</response to (13)>
(14) Are there normative references to documents that are not ready for
advancement or are otherwise in an unclear state? If such normative references
exist, what is the plan for their completion?
<response to (14)>
The normative reference to ZigBee IP needs fixing.
</response to (14)>
(15) Are there downward normative references references (see RFC 3967)? If so,
list these downward references to support the Area Director in the Last Call
procedure.
<response to (15)>
Not applicable to an Informational RFC.
</response to (15)>
(16) Will publication of this document change the status of any existing RFCs?
Are those RFCs listed on the title page header, listed in the abstract, and
discussed in the introduction? If the RFCs are not listed in the Abstract and
Introduction, explain why, and point to the part of the document where the
relationship of this document to the other RFCs is discussed. If this
information is not in the document, explain why the WG considers it unnecessary.
<response to (16)>
The publication of this document will not affect the status of any existing
RFCs. </response to (16)>
(17) Describe the Document Shepherd's review of the IANA considerations section,
especially with regard to its consistency with the body of the document.
Confirm that all protocol extensions that the document makes are associated
with the appropriate reservations in IANA registries. Confirm that any
referenced IANA registries have been clearly identified. Confirm that newly
created IANA registries include a detailed specification of the initial
contents for the registry, that allocations procedures for future registrations
are defined, and a reasonable name for the new registry has been suggested (see
RFC 5226).
<response to (17)>
There are no IANA considerations.
</response to (17)>
(18) List any new IANA registries that require Expert Review for future
allocations. Provide any public guidance that the IESG would find useful in
selecting the IANA Experts for these new registries.
<response to (18)>
There are no new IANA registries.
</response to (18)>
(19) Describe reviews and automated checks performed by the Document Shepherd to
validate sections of the document written in a formal language, such as XML
code, BNF rules, MIB definitions, etc.
<response to (19)>
There are no parts of the document written in a formal language.
</response to (19)>