Re: [secdir] Recurring issues found during sec review

[Paul Wouters <[e-mail]>]

On Tue, 23 Jul 2019, Alan DeKok wrote:

>  Saying "When X do Y" is very much an "if" condition, even though it is not phrased as such.  The solution is to about handle the "else" case to every "if", as with the following example:
>
> 	IF a server receives X
> 	THEN
> 		do Y
> 	ELSE
> 		do something else
>
>  IIRC, the above behaviour is required in medical software.  "No IF without an ELSE".  I believe it should be required for protocol specifications, too.

Right. In our terms that would be more in the sense of, the client MUST
send X. If the server receives a request without X, it MUST do z.

That is, every MUST should have an obvious action for when it is
violated.

And we have the weaker version with SHOULD. For every SHOULD in the
document, the authors should have at least one example of where the
SHOULD case exception is valid. If they cannot come up with that
exception, the SHOULD should be a MUST.

In a way, this process is running a fuzzer against your proposed
specification.

Paul