Re: [saag] Additions to RFC 3631?

As noted by others, RFC 4086 covers that.  It may also need improving; I haven't reread it recently.  However, even a pointer to it is out of place in 3631bis.  3631 is about protocol mechanisms; 4086 is about implementations.  Mouse Mouse's suggestions are more in the domain of 3365, which is security design philosophy.  3631 says "if you want to put security into a protocol, here are the best choices we have today".  My question is whether or not that list should be changed.

On May 21, 2012, at 3:20 04AM, Yaron Sheffer wrote:

> And a short section on crypto-grade random number generation. I would be glad to contribute it.
> 
> 	Yaron
> 
> On 05/21/2012 09:32 AM, Simon Josefsson wrote:
>> Steven Bellovin<smb@cs.columbia.edu>  writes:
>> 
>>> Does anyone have any suggestions for additions or corrections to RFC 3631?
>>> It looks to me like it's held up pretty well, save for newer versions of
>>> some of the protocols.
>> 
>> I think channel bindings ought to be discussed, as a simple way to bind
>> different layers together to avoid certain attacks.  It could be
>> discussed in the SASL or GSS-API section.  Further, I think EAP as a
>> protocol should be included in the list of standard security mechanisms.
>> 
>> /Simon
>> _______________________________________________
>> saag mailing list
>> saag@ietf.org
>> https://www.ietf.org/mailman/listinfo/saag
> 

		--Steve Bellovin, https://www.cs.columbia.edu/~smb