Early Review of draft-ietf-mpls-mna-requirements-13
review-ietf-mpls-mna-requirements-13-secdir-early-harkins-2024-05-02-00

   Hello,

   I have reviewed draft-ietf-mpls-mna-requirements-13 as part of
the security directorate's ongoing effort to review all IETF documents
being processed by the IESG. These comments were written primarily
for the benefit of the security area directors. Document editors and
WG chairs should treat these comments just like any other last call
comments.

   The summary of the review is "Ready with Issues". I wanted to
say Not Ready since my issue seems important to me but others
may not see it that way. ADs, take a look.

   The document specifies requirements solutions to use cases that
specify new operations on MPLS packets. All of the requirements
seem correct (with the possible exception of one which I'll get to)
given my general ignorance of MPLS but my issue is that these
operations are called "Network Actions", which make sense, good
name, but the the actions to be performed are indicated by
"Network Action Indicators (NAIs)". These NAIs are to be encoded
according to RFC 3031, which is the MPLS Architecture document.
RFC 3031 does not specify an encoding of a thing called an NAI.
Unfortunately, RFC 4282 does. It defines a "Network Access
Identifier" which is technically different than a "Network Action
Indicator" but I think the naming in this draft unfortunately needs
to be changed. IESG members who make the decision may disagree
but I find it confusing to see acronyms redefined like this and
unfortunately RFC 4282 was there first.

   The requirement I had a problem with was 38: "NAIs MUST be
allocated through the IANA process specified in the MNA solution
specification." If you're going to define some thing in a draft
(even if you give it a new name) and require IANA to allocate them
then you should have create a registry for these things. Making
the solution documents allocate their own registries for these
things seems wrong, IMHO.

   Also, requirement 28 says, "Pint-to-Point (P2P)"-- cheers!--
should be "Point-to-Point (P2P).

   regards,

   Dan.

-- 
"The object of life is not to be on the side of the majority, but to
escape finding oneself in the ranks of the insane." -- Marcus Aurelius