[saag] rfc5405bis security considerations text

[Stephen Farrell <[e-mail]>]

Hiya,

RFC 5405 provides guidance to folks developing applications
running over UDP. That's being updated now. A lot of that
is about congestion control but there's also some security
considerations text of course. [1]

Some of that security text reads to me like it's fairly
outdated (in particular the bit copied below). While it'd
be nice to fix that, this draft has been approved by the
IESG as the current text, even if outdated, isn't wrong,
so it'd be wrong to block the document on that basis.

That said, if someone had time to offer updated text, in
the next week, that Lars and I were confident would reflect
IETF consensus then Lars has said he'd be willing to use
that.

So if you have the time and interest, please send text to
Lars and I. Sending to the list is fine, but there's no
point in us having a major debate on this, as in that case,
Lars will just reasonably decide to go ahead with the text
he has now.

Thanks in advance,
S.

[1] https://tools.ietf.org/html/draft-ietf-tsvwg-rfc5405bis-19#section-6

The bit of [1] that I thought was most outdated was:

   Many other options for authenticating or encrypting UDP payloads
   exist.  For example, the GSS-API security framework [RFC2743] or
   Cryptographic Message Syntax (CMS) [RFC5652] could be used to protect
   UDP payloads.  There exist a number of security options for RTP
   [RFC3550] over UDP, especially to accomplish key-management, see
   [RFC7201].  These options covers many usages, including point-to-
   point, centralized group communication as well as multicast.  In some
   applications, a better solution is to protect larger stand-alone
   objects, such as files or messages, instead of individual UDP
   payloads.  In these situations, CMS [RFC5652], S/MIME [RFC5751] or
   OpenPGP [RFC4880] could be used.  In addition, there are many non-
   IETF protocols in this area.