Re: [secdir] [Isms] secdir review of draft-ietf-isms-transport-security-model-12

[Barry Leiba <[e-mail]>]

Sam says...
> Or just use lower case should.  I think the advice is important enough
> it does not belong in an appendix.

Indeed.

I didn't mean for my comment to cause a big stir; I think it's easy to sort out.

I like my first suggestion, repeated here:

  by the RFC 3411 architecture.  However, the Transport Security Model
  does not provide security mechanisms such as authentication and
  encryption itself, so it MUST always be used with a Transport Model
  that provides appropriate security.  What is "appropriate" for a particular
  deployment is an administrative decision.  Which threats are addressed
  and how they are mitigated depends on the Transport Model.

...but I'd also be happy with something like this, if you don't want
to use 2119 language:

  by the RFC 3411 architecture.  However, the Transport Security Model
  does not provide security mechanisms such as authentication and
  encryption itself, so deployments should [or "must"] use it with a
Transport Model
  that provides appropriate security.  Which threats are addressed
  and how they are mitigated depends on the Transport Model.

In any case, let's not spend any more time on this one.

Barry
-- 
Barry Leiba  ([e-mail])
http://internetmessagingtechnology.org/