Re: [tcpm] TCP-AO review comments.

On Wednesday 06 August 2008, Lars Eggert wrote:
> So, my current thinking is that AO should maybe move TCP-MD5 to
> "historic". That would indicate that new implementations shouldn't
> implement TCP-MD5 and existing ones are encouraged to move away from
> it. But this isn't a clear -cut case. Comments?

IMHO, "shouldn't implement" in the above phrase should be changed 
to "shouldn't use". For backwards compatibility reasons implementations may 
(or should) (and most probably will) implement TCP-MD5 too.

> and TCP-MD5. AO is a replacement for TCP-MD5, but it isn't a simple  
> revision or extension of TCP-MD5, it's a new mechanism to provide  
> similar functionality in a (slightly) different way.

Following your thoughts: Since TCP-AO is mutually exclusive with TCP-MD5, one 
cannot view them as two distinct options. This means that TCP-AO is actually 
a replacement of TCP-MD5 and we can also describe it as a 'newer, 
backwards-incompatible version' of the existing authentication mechanism of 
TCP. Having this in mind, perhaps 'obsoletes' is correct.

Also, is there any good in including a (1-byte - or smaller with some unused 
bits) version field in TCP-AO? This will help similar future 
extensions/replacements and will also allow for easier authentication option 
handshaking by falling back to the highest commonly supported method.
_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www.ietf.org/mailman/listinfo/tcpm