Subject: [karp] Security Considerations text added to draft-ietf-karp-threats-reqs-04

From: Brian Weis <[email-masked]>
Date: Fri, 6 Apr 2012 16:02:51 -0700

(Speaking as a WG member.)

The text added to the Security Considerations document describes issues inherent in using a group key, and then adds a requirement that design teams need to make choices about stopping a BYZANTINE actor. The general guidance is good, but because Section 3.3 clearly states that threats from a BYZANTINE actor are out of scope it seems wrong to require design teams to defend against them. I suggest that the last sentence in this paragraph be removed.

Brian

-- 
Brian Weis
Security Standards and Technology, SRTG, Cisco Systems
Telephone: +1 408 526 4796
Email: [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Mon, 09 Apr 2012 14:37:44 -0400

I'd like to support Brian's concerns with this text and with requirement
22.