Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Anantha Ramaiah (ananth) wrote:
...
> If we have to fix multiple layers, lets fix it, I have no problems. You
> can do all at once or piecemeal, as simple as that. It doesn't matter
> whether spoofing is standalone or not, it is about how well you can make
> your TCP stack respond to such malicious attacks, if you care to do so.

TCP is not a secure protocol. It's not intended for protection from
malicious attacks per se; 'fixing' it is to assert your solution on
everyone, as below.

>>> - TCP secure, TCP MD5, TCP advanced security algorithms, 
>> IPsec are all 
>>> different tools with varying degrees of complexity and 
>> usage. A user 
>>> can chose to use one of them depending on his/her requirements. 
>>> Telling people to only use IPsec is akin to saying "always fly in 
>>> business class". Yes I have used this analogy before, but 
>> this is one 
>>> whih popped up in mind after today's coffee :-)
>> If we agree that users should be able to choose the solution 
>> that fits, let's go with MAYs all around.
> 
> I know you want all MAY's in place. Some others (includes me) are not
> yet convinced that why SHOULD doesn't provide the same assurance.
> 
>> Otherwise, aren't you dictating your solution as fitting 
>> everyone's needs?
> 
> I am not "dictating" anything here. I am just supporting the reason why
> I feel it should be SHOULD's :-) 

SHOULD dictates that everyone's TCP ought to have this included except
for specific good reason. MAY allows them to make the choice themselves.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm