[Pals] Stephen Farrell's Abstain on draft-ietf-pals-rfc4447bis-05: (with COMMENT)

["Stephen Farrell" <[e-mail]>]

Stephen Farrell has entered the following ballot position for
draft-ietf-pals-rfc4447bis-05: Abstain

When responding, please keep the subject line intact and reply to all
email addresses included in the To and CC lines. (Feel free to cut this
introductory paragraph, however.)


Please refer to https://www.ietf.org/iesg/statement/discuss-criteria.html
for more information about IESG DISCUSS and COMMENT positions.


The document, along with other ballot positions, can be found here:
https://datatracker.ietf.org/doc/draft-ietf-pals-rfc4447bis/



----------------------------------------------------------------------
COMMENT:
----------------------------------------------------------------------

It is an embarrassment that we can't do better than TCP MD5.
TCP MD5 (from 1998, RFC2385) has been obsoleted by TCP-AO
(RFC 5925, from 2010), but that hasn't seen deployment.

Back in 1998 (18 years ago!) RFC 2385 included an IESG note
that says:

"This document describes current existing practice for
securing BGP against certain simple attacks.  It is
understood to have security weaknesses against concerted
attacks."

And all these years later we can still do no better when
promoting a document to IS.  Sigh.

However, I see no point in trying to block this document on
that basis. 

I would argue for an IESG note along the above lines if I
thought that'd have any impact, but I guess it won't if, as
seems to be the case, people won't move until there's a
catastrophic break.