IESG, OPS-DIR and Authors,

I reviewed "Supporting Authentication Trailer for OSPFv3"  (draft-ietf-ospf-rfc6506bis-02) for operational impact.


Intended Status: Standards Track

Current Draft Status: IESG Last Call

Summary:  This document defines an alternative mechanism to authenticate OSPFv3 protocol packets using an Authentication Trailer (versus using IPSec). The document also outlines mechanism allowing implementations supporting this authentication method to operate with older implementations not supporting this authentication method.




This document is set to replace RFC6506 providing updates and includes Errata items.

I do not see any operational impact with publication based on what is currently specified in this draft.




Summary Feedback Points:

(1) The document addresses Errata items from RFC6506 and provides updated text around invalid keys usage and backward compatibility

(2) The document does address, to a greater extent then RFC6506 backward compatibility with older OSPFv3 implementations not supporting this newer authentication method (outlined in section 5)




(3) Section 5 provides a well described list of behaviours necessary by routers implementing the new authentication method to be backwards compatible with older implementations that do not support the new functions (This is important to operators as transitionary functionally is very important)




(4) If implemented as specified, this helps operators further secure their environments while supporting transition often needed for network implementation

(5)  I do not see any issues from an operational perspective to publication




Additional Feedback:

(6) Given that implementations of this new authentication method can exist for long periods of time in environments where at least one router may not support the new methods, some additional text in the security section may be beneficial to describe that exposure (this is not necessary since this point can be gleaned by the reader who is operationally aware , but just an option)




Optional Text that can be added in security section (Section 6) if desired:

<text>

Deployments supporting a transitionary state which interoperate with routers that do not support this authentication method may be exposed to unauthenticated data during the transition period.




</text>

regards,

Victor Kuarsingh