Last Call Review of draft-gont-numeric-ids-sec-considerations-06
review-gont-numeric-ids-sec-considerations-06-secdir-lc-kaufman-2021-01-05-00

I have reviewed this document as part of the security directorate's ongoing
effort to review all IETF documents being processed by the IESG.  These
comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other
last call comments.

This document (with intended status of BCP) offers (necessarily) vague advice
on what specs should say about the selection of transient numeric identifiers
used in networking protocols (like TCP sequence numbers, DNS TxIDs, IP Fragment
Identifiers, etc.). It updates RFC 3552 ("Guidelines for Writing RFC Text on
Security Considerations") in the sense that it offers additional guidance for
information to be included in security considerations, though it more
importantly offers guidance on how the text prescribing how these transient
identifiers are chosen should be specified. The security considerations might
include a justification of why those algorithms are appropriate.

Essentially, it says that when picking transient numeric identifiers, beware of
leaking information about other things going on at the node choosing the
identifiers to either eavesdroppers or to the legitimate target of the
communication (or making it possible for someone off-path to guess the
identifiers being used and forge packets). There is ample history of
implementers making bad choices in this space to warrant getting the advice out
there. My only reservation with this document is that it would be nice if the
advice could be somewhere more visible (e.g., in some future update to RFC3552).

There are three other I-Ds in process with closely related content; it would be
kind to readers if these could be combined into one. They are:
draft-gont-predictable-numeric-ids, draft-irtf-pearg-numeric-ids-generation,
and draft-irtf-pearg-numeric-ids-history. It's hard to imagine a reader of any
one of these who would not benefit from reading the others.

Typos:

p6 Section 4: "to be a predictable" -> "to be predictable"
"identifiers in other context" -> "identifiers in another context"

--Charlie