Re: [saag] should we revise rfc 3365?

[Nico Williams <[e-mail]>]

I think we should say "should specify a MTI security feature" with
guidance as to when not to make it MTI or when not to bother
specifying the thing at all.  I-D authors should be required to
address this in the security considerations section.  Perhaps we
should stop at "tell us what you're doing about security and the
rationale for having or not having an MTI security feature".  The IETF
and IESG can review this and decide whether to insist that a protocol
have/not have a security feature.

Then DHCP could lack an explicit security feature on account of DHCP
being best secured by the link layer (the router/switch).  And so on.

Nico
--