Hi, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The Routing Over Low power and Lossy network (ROLL) Working Group has been chartered to work on routing solutions for Low Power and Lossy networks (LLN) in various markets: Industrial, Commercial (Building), Home and Urban networks. Pursuant to this effort, this document defines the IPv6 routing requirements for building automation. First, this document has no section named "Security Considerations". There is a "Security Requirements" sub-section (5.8) which looks like it might be the "Security Considerations" section misnamed and poorly placed in the document structure. Second, the new "Security Requirements" sub-section matches the contents of the "Security Considerations" section of version 05 of this document, almost word-for-word. Therefore my review from version 05 still applies. Here is what I said: > The Security Considerations appear to take into account various > requirements for different systems. What seems to be lacking is > direction about how or when to apply various requirements and what > it means to the deployment. > > For example, what would it mean to a deployment if it has > authentication versus not having authentication? Also, it's unclear > how these requirements would apply to an implementor. > > Variable security policies is a good idea, but it requires more > guidance because the end user will never understand the ramifications > of choosing one policy over another. -derek -- Derek Atkins 617-623-3745 derek at ihtfp.com www.ihtfp.com Computer and Internet Security Consultant