Last Call Review of draft-ietf-grow-bmp-local-rib-10
review-ietf-grow-bmp-local-rib-10-secdir-lc-lonvick-2021-03-29-00

Request Review of draft-ietf-grow-bmp-local-rib
Requested rev. no specific revision (document currently at 10)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2021-03-29
Requested 2021-03-15
Authors Tim Evens, Serpil Bayraktar, Manish Bhardwaj, Paolo Lucente
Draft last updated 2021-03-29
Completed reviews Rtgdir Last Call review of -10 by Loa Andersson
Secdir Last Call review of -10 by Chris Lonvick
Genart Last Call review of -10 by Thomas Fossati
Assignment Reviewer Chris Lonvick 
State Completed
Review review-ietf-grow-bmp-local-rib-10-secdir-lc-lonvick-2021-03-29
Posted at https://mailarchive.ietf.org/arch/msg/secdir/t8cuYma97iLnKlfTwaUAKim8j48
Reviewed rev. 10
Review result Has Nits
Review completed: 2021-03-29

Review
review-ietf-grow-bmp-local-rib-10-secdir-lc-lonvick-2021-03-29

Hello,

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments.

The summary of the review is READY.

The authors state in the Security Considerations section that the same considerations that are documented in Section 11 of RFC 7854 also apply to this document. I see no reason to doubt that and I believe that is appropriate for this document.

The second and third sentences of the Security Considerations section may need to be reworked. Although I skimmed the rest of the document, these were the only nits I could see. 

For the second sentence, rather than:
Implementations of this protocol SHOULD require to establish sessions with authorized and trusted monitoring devices.
Perhaps, 
Implementations of this protocol SHOULD require  +monitored routers+  to establish  +secure+  sessions with authorized and trusted monitoring  -devices-+stations+.
The term "monitoring devices" is not used anywhere else in the document, and only once in RFC 7854. On the other hand "monitoring stations" is used extensively in both.

For the third sentence, rather than:
It is also believed that this document does not add any additional security considerations.
Perhaps,
It is also believed that this document does not add any  +features that require any+  additional security considerations.

Best regards,
Chris