On the Generation of Transient Numeric Identifiers
draft-irtf-pearg-numeric-ids-generation-12

# Internet AD comments for {draft-irtf-pearg-numeric-ids-generation-11}
CC @ekline

## Discuss

### S6

* Note (7): I'm not sure why this is failure severity None.  Predictable
  DNS query IDs allow an off-path attacker greater probability of injecting
  false data.

## Comments

### S3

* As with the other document, I think you can just come straight out and say
  "we don't consider on-path attackers", or something to similar effect.

### S6

* Note (1): I suspect there has to be a more precise verb than "trash".

* Note (6): RFC 6437 might be useful reference here.

### S7.3

* If you're going to (rightly) say that HMAC-MD5 is not recommended you might
  also consider noting that HMAC-SHA1 is not without concern (RFC 6194).

### S8.4

* "MAC address ... which identifies the vendor" ->
  "... which *may* identify the vendor"

### S8.6

* Seems like DNS forged answer injection attacks might be mentioned here.

## Nits

### S7.2

* "not possible employ" -> "not possible to employ"

(Via drafts-eval@iana.org): IESG/Authors/ISE:

The IANA Functions Operator has reviewed draft-irtf-pearg-numeric-ids-generation-11 and has the following comments:

We understand that this document doesn't require any registry actions.

While it's often helpful for a document's IANA Considerations section to remain in place upon publication even if there are no actions, if the authors strongly prefer to remove it, we do not object.

If this assessment is not accurate, please respond as soon as possible.

Thank you,

Amanda Baber
IANA Operations Manager

This document originally lived in draft-gont-predictable-protocol-ids along with draft-irtf-pearg-numeric-ids-history and draft-gont-numeric-ids-sec-considerations and was later on broken up into 3 separate drafts. This particular document concerns itself with analyzing the security and privacy aspects of numeric identifiers used by various IETF protocols and provides guidance on writing algorithms that generate transient numeric identifiers.

In general this document is well-written and comprehensive. It went through  review in its previous incarnation and the PEARG chairs asked for an early TSVART review that raised comments that the authors addressed in subsequent revisions. No additional comments were received in the PEARG Last Call.

The chairs consider this document ready to proceed to IRSG last call.