I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document presents no new security considerations over the RFC it seeks to update. For a provisioning protocol the primary security considerations relate to authentication, which does not belong here, and authorization, which does belong here. The security considerations section of this I-D appears to be complete. Nico --