Reviewer: Leif Johansson Review result: Has Issues I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. I am not a subject matter expert but overall I find the document well written and readable. The issue I have is in the security considerations section where I really think there should be normative language around the use of permanent identifiers. In particular: "Thus, every single touch connection can use a different short address of NFC link with an extremely short-lived link. This can mitigate address scanning as well as location tracking and device-specific vulnerability exploitation." This is imo too weak. I suggest reformulating this and related text to normative language. Given the possible consequences of NFC correlation attacks I would have thought that a mandatory requirement on generating different short addresses for every link would be a good idea.
