RE: [tcpm] tcpsecure: how strong to recommend?

Mark, Joe et al,

My inclination is to suggest -
   "all SHOULDs"

A second choice would be -
    "two SHOULDs and a MAY"

As far as I can see, the proposed mechanisms bring value to users and to the Internet at large, 
are relatively simple and backward compatible and do not (seem to) break anything. 
I would be hesitant leaving them as "MAY"; vendors should be strongly encouraged 
to implement security mechanisms.

Regards,
Anil

Anil Agarwal
ViaSat Inc.
Germantown, MD

________________________________

From: Joe Touch [mailto:touch@ISI.EDU]
Sent: Mon 9/24/2007 6:34 PM
To: mallman@icir.org
Cc: tcpm@ietf.org
Subject: Re: [tcpm] tcpsecure: how strong to recommend?

I'd encourage others to weigh in on this. I'm uncomfortable with our
making recommendations to change TCP's fundamental behavior as a SHOULD
on the basis of a handful of representatives.

Joe

Mark Allman wrote:
> 
> Folks-
>
> The seeming last issue with the tcpsecure document is how strong to
> recommend the various mitigations.  To review, there are three
> mitigations for RST, SYN and data injection attacks.  The question is
> whether to say that a TCP (1) MAY use all these mitigations, (2) SHOULD
> use all these mitigations or (3) SHOULD use the mitigations for the RST
> & SYN attacks and MAY use the data injection mitigation.  Clearly there
> are other permutations (and one could also bring MUST and MUST NOT into
> the conversation), however these three options have been voiced.  If you
> have some other permutation then voice it.
>
> In the meeting in Chicago we took a "visual hum" and the tally looks
> like this:
>
>       all SHOULDs: 4
>       all MAYs: 3
>       two SHOULDs and a MAY: 8
>
> So, our inclination is to go with option (3) from my list above.  If you
> think this is the wrong way to go please yell---especially if you are
> not reflected in the 15 folks who took part in the visual hum.
>
> Thanks,
> allman
>
>
>
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> tcpm mailing list
> tcpm@ietf.org
> https://www1.ietf.org/mailman/listinfo/tcpm