From 8a8ddce92d4a3763b7217c6c03229fc9a75e2ae6 Mon Sep 17 00:00:00 2001
From: Randy Bush <randy@psg.com>
Date: Fri, 18 Feb 2022 03:17:15 -0800
Subject: [PATCH] tls 1.1 or greater

---
 draft-ymbk-idr-l3nd.xml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/draft-ymbk-idr-l3nd.xml b/draft-ymbk-idr-l3nd.xml
index 9457578..11cbc93 100644
--- a/draft-ymbk-idr-l3nd.xml
+++ b/draft-ymbk-idr-l3nd.xml
@@ -1126,6 +1126,8 @@ Flags (bit):
 
   <section anchor="security" title="Security Considerations">
 
+    <t>TLS version 1.1 or later MUST be used.</t>      
+
     <t>The protocol as is MUST NOT be used outside a datacenter or
     similarly closed environment without using TLS encapsulation which
     is based on a configured CA trust anchor.</t>
@@ -1146,8 +1148,9 @@ Flags (bit):
     <t>Similarly, malicious nodes/devices could mis-announce
     addressing.</t>
 
-    <t>If OPENs are not using validated TLS, an attacker could forge an
-    OPEN for an existing session and cause the session to be reset.</t>
+    <t>If OPEN PDUs are not over validated TLS, an attacker could forge
+    an OPEN for an existing session and cause the session to be
+    reset.</t>
 
     </section>