Title: review of draft-ietf-l3vpn-as4octet-ext-community-03 I reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG.  These comments were written primarily for the benefit of the security area directors.  Document editors and WG chairs should treat these comments just like any other last call comments. Draft-ietf-l3vpn-as4octet-ext-community-03.txt is a very brief (6 page) document that defines a new type of BGP extended community, one that can carry 32-bit AS numbers. It is a simple, logical successor to the existing extended community structure, which is limited to representing 16-bit AS numbers. The Security Considerations section states that "All the security considerations for BGP Extended Communities apply here."  This may not be very informative for the average reader. I thought it might be preferable to include references here to relevant Security Considerations sections from prior RFCs dealing with this topic. So, I looked at RFC 4360 (BGP Extended Communities Attribute), since that is the document that is being extended to accommodate 32-bit ASNs. However, that document has a largely vacuous security considerations section: "This extension to BGP has similar security implications as BGP Communities [RFC1997]. This extension to BGP does not change the underlying security issues. Specifically, an operator who is relying on the information carried in BGP must have a transitive trust relationship back to the source of the information.  Specifying the mechanism(s) to provide such a relationship is beyond the scope of this document." I then looked at RFC 1997, and discovered that its Security Considerations section states: "Security issues are not discussed in this memo." I suggest the authors take the time to write a meaningful Security Considerations section addressing BGP Extended Communities, since none of the prior documents on this topic seem to have done so.