Hello, I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. The summary of the review is "Ready with nits". The nits are: - maybe it's the source or maybe it's datatracker, but there are two references in section 1 (the first word of the 2nd and 3rd paragraph) that should be hotlinked but aren't. - the problem statement in section 1 is a bit confusing. It says that "[RFC8126] gives guidelines for listing in the myriad IANA registries." Full stop, end of paragraph. Then next paragraph it says how an earlier document, RFC 6014, updated the requirements for how values in some registries get assigned. So... 6014 didn't follow 8126 because it didn't exist yet. So what's the point of mentioning 8126? Yes, it lists guidelines...and? I don't think anything will be lost in the draft if the entire 2nd paragraph of section 1 (the single sentence) and its Normative Reference are removed. Suggest doing so. - the Security Considerations should, I think, instruct the reader that the burden for deciding between "good algorithms" and "bad algorithms" belongs to the implementer/user now. There's a decision that now has to be made-- it can't be passed off to the IETF and their Standards Action-- and there are security considerations to that decision. I suggest that be highlighted. regards, Dan. -- "The object of life is not to be on the side of the majority, but to escape finding oneself in the ranks of the insane." -- Marcus Aurelius