Last Call Review of draft-ietf-netvc-requirements-09
review-ietf-netvc-requirements-09-secdir-lc-dunbar-2019-05-28-00

Request Review of draft-ietf-netvc-requirements
Requested rev. no specific revision (document currently at 10)
Type Last Call Review
Team Security Area Directorate (secdir)
Deadline 2019-06-04
Requested 2019-05-21
Authors Alexey Filippov, Andrey Norkin, José Alvarez
Draft last updated 2019-05-28
Completed reviews Genart Last Call review of -09 by Paul Kyzivat (diff)
Tsvart Last Call review of -09 by Bernard Aboba (diff)
Secdir Last Call review of -09 by Linda Dunbar (diff)
Assignment Reviewer Linda Dunbar
State Completed
Review review-ietf-netvc-requirements-09-secdir-lc-dunbar-2019-05-28
Posted at https://mailarchive.ietf.org/arch/msg/secdir/7aaKsnYXrj8jJZEscnks99nDWww
Reviewed rev. 09 (document currently at 10)
Review result Has Nits
Review completed: 2019-05-28

Review
review-ietf-netvc-requirements-09-secdir-lc-dunbar-2019-05-28

I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.
 Document editors and WG chairs should treat these comments just like any other last call comments.

This document describes the overview of internet Video codec applications and the corresponding requirements. However, it doesn't cover any security requirement.  

Section 5 on Security Consideration description doesn't make sense to me. It stats that  not covering worst case of computational complexity/memory bandwidth can be considered as security vulnerability and lead to denial of services (DoS) in the case of attacks. 

why ?

what are "the worst case of computational complexity/memory bandwidth"? why covering them can eliminate the "security vulnerability"? 

Linda Dunbar