Re: [secdir] secdir review of draft-ietf-appsawg-rrvs-header-field

[Alexey Melnikov <[e-mail]>]

On 20/03/2014 10:58, Stephen Farrell wrote:
> On 03/20/2014 08:36 AM, Murray S. Kucherawy wrote:
>> I can't recall the exact reason why it's been said that RFC2119 language
>> ought not be used in Security Considerations (or similar) prose, or which
>> document's development cycle brought it up, but my general recollection is
>> that those words were intended to convey aspects of interoperability having
>> to do with protocol elements, and not otherwise.  It would appear this
>> opinion has formed since RFC3552 was published, since obviously there's a
>> conflict between them.  But like I said, it does seem to vary depending on
>> who and when one is asking.  Could also be the person(s) who told me this
>> are actually plain wrong.
>>
>> I'm happy to take direction from the sponsoring AD on this one.
> I'm sure you'll get that.
>
> FWIW, from my POV there should be no magical interactions between
> RFC section headings and RFC 2119. You should do what makes sense
> and is more clear for the reader. That can and often does include
> using e.g. a 2119 MUST in the security considerations section.
>
> In other words, I figure the folklore you describe above ought be
> ignored and/or corrected.
Agreed.
> I do not believe that's written down
> anywhere in an RFC or IESG statement,
I don't think so either.

I think the main argument against RFC 2119 language in Security 
Considerations sections is that people are not going to read them while 
implementing specs (and they might only read them later when considering 
security aspects). But I think this is nonsense.
> if you find it is, please let me know and I'll try get it fixed.