Re: [tcpm] tcp-security: Request for feedback on the outline of the document

["Eddy, Wesley M. (GRC-MS00)[Verizon]" <[e-mail]>]

>-----Original Message-----
>From: [e-mail] [mailto:[e-mail]] On Behalf Of
>[e-mail]
>Sent: Tuesday, September 01, 2009 7:11 AM
>
>> Again: the goal of this document is helping TCP implementers harden
>> their TCPs. And for that target, having everything about a protocol
>> field in a single place is the only document outline that does not get
>> in the middle of the developer and the implementation. If you spread
>> the
>> advice among lots of places, this is what will happen: some
>mitigations
>> will be missed.
>
>So if this is entirely aimed at implementers shouldn't that be
>explicitly stated in the title? I appreciate that in theory BCP is meant
>to imply implementation guidance but this might be more appropriately
>titled something like "Implementers guidelines for mitigating TCP
>security threats" or "Guidance on secure implementation of TCP"
>


This is a great point; in fact, the milestone we put on the TCPM charter
says:

"Submit document on security hardening of TCP implementations to the IESG
for publication as a Best Current Practices RFC"

so the titles you suggested, or something else that indicates "Secure TCP
Implementation" would probably be more appropriate than the "Security
Assessment ..." title it currently has.

---------------------------
Wes Eddy
Network & Systems Architect
Verizon FNS / NASA GRC
Office: [phone]
---------------------------