Re: [tcpm] Roman Danyliw's Discuss on draft-ietf-tcpm-yang-tcp-07: (with DISCUSS and COMMENT)

["Scharf, Michael" <[e-mail]>]

Hi Roman,

The authors will get back to all feedback (in particular the various DISCUSS). We still work on that.

For the time being, one specific question regarding your comment:

> ----------------------------------------------------------------------
> COMMENT:
> ----------------------------------------------------------------------
> 
> Thank you to Hilarie Orman for the SECDIR review.
> 
> I concur with the SECDIR observation that “there are no statistics kept for
> authentication failures.  If a shared key falls out of synch, the statistics
> might help detect that.”  I appreciate the response
> (https://mailarchive.ietf.org/arch/msg/secdir/BnjVJ7_IgN7mSNaGi3H2ujVYv
> n0/)
> which recommends that this should be generically modeled.  I disagree that
> this
> should be deferred. There is a very specific TCP-level primitive being
> described here and it makes sense to me to provide a corresponding logging
> primitive.

The document uses the RFC 8177 keychain with some (relatively minor) additions. Can you please better explain what would - in your view - be different between a TCP-AO authentication failure and an authentication failure by any other use of RFC 8177? Why would generic statistics for all RFC 8177 users not be possible at all?

Or, in other words, what would be different between a counter that sums up TCP-AO authentication failures and a corresponding counter for authentication failures for some other use of RFC 8177?

Thanks

Michael