Re: [secdir] secdir review of draft-ietf-tcpm-tcpmss-04

[David Borman <[e-mail]>]

On May 30, 2012, at 3:47 PM, Scharf, Michael (Michael) wrote:

>>>> I don't have a strong opinion about the current content of the 
>>>> Security Considerations section.  My leaning is to just 
>> leave it as 
>>>> is, but I'd be fine with moving the content up to section 
>> 5.4 as an 
>>>> "Additional Consideration", and then have section 6, "Security 
>>>> Considerations" just have a comment that there are no security 
>>>> considerations, if folks generally feel that would be better.
>>> 
>>> I don't feel comfortable with a security consideration that 
>> isn't, so I would lean towards your alternative proposal.
>> 
>> Ok, I'll move the content to section 5, and leave "Security 
>> Considerations"
>> empty, unless someone else objects to making that change.
> 
> Instead of an empty security considerations section, you could also add a sentence explaining that the document just clarifies what is mandated by RFC 1122, and that it thus does not result in new security issues.
> 
> According to the working group discussions and the WGLC feedback, TCPM is apparently not aware of any security issues with this draft, and I think that TCPM would be fine with mentioning this more explicitly.

Ok, how about:
	This document clarifies how to determine what 
	value should be used for the MSS option, and does
	not introduce any new security concerns.

			-David Borman

> 
> Just a thought...
> 
> Michael (as document shepard)

----------------------------------------------------------------------
The information contained in this transmission may be confidential. Any disclosure, copying, or further distribution of confidential information is not permitted unless such privilege is explicitly granted in writing by Quantum. Quantum reserves the right to have electronic communications, including email and attachments, sent across its networks filtered through anti virus and spam software programs and retain such messages in order to comply with applicable data security and retention requirements. Quantum is not responsible for the proper and complete transmission of the substance of this communication or for any delay in its receipt.