Re: [secdir] [Isms] secdir review ofdraft-ietf-isms-transport-security-model-12

How about just losing the capitalization?

> -----Original Message-----
> From: secdir-bounces@ietf.org [mailto:secdir-bounces@ietf.org] On
> Behalf Of David B Harrington
> Sent: Wednesday, May 06, 2009 5:44 AM
> To: 'Barry Leiba'
> Cc: isms@ietf.org; iesg@ietf.org; isms-chairs@tools.ietf.org;
> secdir@ietf.org
> Subject: Re: [secdir] [Isms] secdir review ofdraft-ietf-isms-transport-
> security-model-12
> 
> Hi Barry,
> 
> your formulation is "MUST ... use", where "use" is a deployment
> decision, and MUST is inappropriate for deployment advice.
> We currently use "SHOULD ... use", but Jeff thinks that in
> inappropriate as well.
> 
> How about:
>     by the RFC 3411 architecture.  However, the Transport Security
> Model
>     does not provide security mechanisms such as authentication and
>     encryption itself, so operators are advised to always use this
>     with a Transport Model
>     that provides appropriate security, where "appropriate" for a
> particular
>     deployment is an administrative decision.  Which threats are
> addressed
>     and how they are mitigated depends on the Transport Model.
> 
> dbh
> 
> > -----Original Message-----
> > From: barryleiba@gmail.com [mailto:barryleiba@gmail.com] On
> > Behalf Of Barry Leiba
> > Sent: Tuesday, May 05, 2009 4:04 PM
> > To: David B Harrington
> > Cc: secdir@ietf.org; iesg@ietf.org; isms@ietf.org;
> > isms-chairs@tools.ietf.org
> > Subject: Re: [Isms] [secdir] secdir review
> > ofdraft-ietf-isms-transport-security-model-12
> >
> > > That is a deployment decision made by an administrator who has an
> > > understanding of what is appropriate to the system in question.
> > >
> > > What is the correct non-RFC2119 phrase in which to couch our
> > > deployment advice?
> >
> > Well, this would make me happy; would it work for you (and others)?:
> >
> > OLD:
> >    by the RFC 3411 architecture.  However, the Transport
> > Security Model
> >    does not provide security mechanisms such as authentication and
> >    encryption itself, so it SHOULD always be used with a
> > Transport Model
> >    that provides appropriate security.  Which threats are
> > addressed and
> >    how they are mitigated depends on the Transport Model.
> >
> > NEW:
> >    by the RFC 3411 architecture.  However, the Transport
> > Security Model
> >    does not provide security mechanisms such as authentication and
> >    encryption itself, so it MUST always be used with a Transport
> Model
> >    that provides appropriate security.  What is "appropriate"
> > for a particular
> >    deployment is an administrative decision.  Which threats
> > are addressed
> >    and how they are mitigated depends on the Transport Model.
> >
> > Barry
> >
> 
> _______________________________________________
> secdir mailing list
> secdir@ietf.org
> https://www.ietf.org/mailman/listinfo/secdir