Subject: [Netconf] Kathleen Moriarty's No Objection on draft-ietf-netconf-call-home-15: (with COMMENT)

From: "Kathleen Moriarty" <[email-masked]>
Date: Mon, 14 Dec 2015 16:24:04 -0800

Kathleen Moriarty has entered the following ballot position for
draft-ietf-netconf-call-home-15: No Objection

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)

Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.

The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-netconf-call-home/

----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

Thank for addressing my prior discuss points!

In section 1.3, please add a sentence that points to the threat/security
analysis for use of this function with NETCONF and RESTCONF after the
last sentence:

   In such circumstances, allowing the SSH/TLS server to contact the
   SSH/TLS client would open new vulnerabilities.  Any use of call home
   with SSH/TLS for purposes other than NETCONF or RESTCONF will need a
   thorough, contextual security analysis.

---

From: Kent Watsen <[email-masked]>
Date: Tue, 15 Dec 2015 16:31:30 +0000

Hi Kathleen,

I think the COMMENT below is a holdover from Oct 21st.  I believe that this comment is addressed with the changes made to -15, which now has this at the end of Section 1.3:

   In such circumstances, allowing the SSH/TLS server to contact the
   SSH/TLS client would open new vulnerabilities.  Any use of call home
   with SSH/TLS for purposes other than NETCONF or RESTCONF will need a
   thorough contextual risk assessment.  A risk assessment for this RFC
   is in the Security Considerations section (Section 5).

Just wondering if there is something I should do now, or if the COMMENT is being kept more for posterity?  This may be, as I see other IESG COMMENTS on https://datatracker.ietf.org/doc/draft-ietf-netconf-call-home/ballot/, even though -15 addresses them as well.  Please advise.

Thanks,
Kent

---

From: Kathleen Moriarty <[email-masked]>
Date: Tue, 15 Dec 2015 11:41:15 -0500

Hi Kent,

Yes, there is no need to worry about the comment.  They don't hold up
documents and the responsible AD makes a judgement call whether or not
they should even be addressed.  I think we are good on this one.

Thanks very much for the follow up!
Kathleen

-- 

Best regards,
Kathleen