Last Call Review of draft-wu-l3sm-rfc8049bis-05
review-wu-l3sm-rfc8049bis-05-secdir-lc-shekh-yusef-2017-09-27-00

I have reviewed this document as part of the security directorate's
ongoing effort to review all IETF documents being processed by the
IESG.  These comments were written primarily for the benefit of the
security area directors.  Document editors and WG chairs should treat
these comments just like any other last call comments.

Summary: Ready with issues


The document defines a YANG data model that defines service configuration
elements that can be used in communication protocols between customers
and network operators. Those elements can also be used as input to
automated control and configuration applications.



Issues
======

* Section 6.9, Security

This section has an Authentication and Encryption sub-sections that apply
to the site.

As per section 6:
   "Authorization of traffic exchange is done through what we call a VPN
    policy or VPN service topology defining routing exchange rules
    between sites."

It might be useful to add an Authorization sub-section to section 6.9 to
capture that security aspect of the model.



* Section 10, Security Considerations

"..., and the server MUST authenticate client access to any protected resource."

There is a need to differentiate between authentication and authorization.
How about the following:
    "..., and the server MUST authenticate the client and authorize access
    to any protected resource."



* Section 10, Security Considerations

"The data nodes defined in the "ietf-l3vpn-svc" YANG module MUST be
carefully created, read, updated, or deleted as appropriate."

I think the above statement is too general, and need to be more specific.
I am assuming that the above statement is trying to say that the identity
of the requestor must be authenticated, and the operations on the model
must be controlled based on authorization associated with the
authenticated entity.

If that is the case, then this should be clearly spelled out.



Nits
====

* Section 6.9.2. Encryption

"A hitless key-change mechanism may be added through augmentation."
Replace "key-change" with "key-exchange"

Regards,
 Rifaat