Re: [secdir] Recurring issues found during sec review

[Paul Wouters <[e-mail]>]

On Tue, 23 Jul 2019, Salz, Rich wrote:

>    > That is, every MUST should have an obvious action for when it is
>    > violated.
>
>      That's a good phrasing.
>
> I strongly disagree.  It turns every MUST into something that only the recipient must act on.

Unless it is MUST ignore ?

>  The burden of the protocol should be on both sides to act correctly

Indeed, the document would already state not to send malformed data. But
the responder/server will be the endpoint dealing with those violations.

> , and one side should not be constrained to behave a particular way if the counter-party misbehaves. Another reason against this is that it tends to result in naïve behavior such as oracles or "name not found" being distinguished from "wrong password"

I think we are not saying different things. If the action of a MUST is
not obvious (eg drop packet), and there are security issues into giving
too specific error codes as the example you bring up, it is precisely
why the document should tell you what to do. I'm not saying every MUST
must have a specific and immediate sentence following saying what to do.

For example, IKEv2 has a very limited set of error codes specifically
to cover your concern here. INVALID_SYNTAX, AUTHENTICATION_FAILED and
NO_PROPOSAL_CHOSEN. With the latter one being the kitchen sink of
errors.

Paul