RE: [tcpm] tcpsecure: how strong to recommend?

"Anantha Ramaiah \(ananth\)" <ananth@cisco.com> Tue, 25 September 2007 21:15 UTC

Return-path: <tcpm-bounces@ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaHkN-0003jF-S7; Tue, 25 Sep 2007 17:15:11 -0400
Received: from [10.91.34.44] (helo=ietf-mx.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IaHkM-0003j8-9U for tcpm@ietf.org; Tue, 25 Sep 2007 17:15:10 -0400
Received: from sj-iport-6.cisco.com ([171.71.176.117]) by ietf-mx.ietf.org with esmtp (Exim 4.43) id 1IaHkG-000294-3P for tcpm@ietf.org; Tue, 25 Sep 2007 17:15:10 -0400
X-IronPort-AV: E=Sophos;i="4.20,297,1186383600"; d="scan'208";a="224973012"
Received: from sj-dkim-3.cisco.com ([171.71.179.195]) by sj-iport-6.cisco.com with ESMTP; 25 Sep 2007 14:14:57 -0700
Received: from sj-core-5.cisco.com (sj-core-5.cisco.com [171.71.177.238]) by sj-dkim-3.cisco.com (8.12.11/8.12.11) with ESMTP id l8PLEvxi019099; Tue, 25 Sep 2007 14:14:57 -0700
Received: from xbh-sjc-221.amer.cisco.com (xbh-sjc-221.cisco.com [128.107.191.63]) by sj-core-5.cisco.com (8.12.10/8.12.6) with ESMTP id l8PLEb7p013007; Tue, 25 Sep 2007 21:14:47 GMT
Received: from xmb-sjc-21c.amer.cisco.com ([171.70.151.176]) by xbh-sjc-221.amer.cisco.com with Microsoft SMTPSVC(6.0.3790.1830); Tue, 25 Sep 2007 14:14:17 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.5
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
Subject: RE: [tcpm] tcpsecure: how strong to recommend?
Date: Tue, 25 Sep 2007 14:14:08 -0700
Message-ID: <0C53DCFB700D144284A584F54711EC5804051D95@xmb-sjc-21c.amer.cisco.com>
In-Reply-To: <20070925184738.2C7682A88A7@lawyers.icir.org>
X-MS-Has-Attach:
X-MS-TNEF-Correlator:
Thread-Topic: [tcpm] tcpsecure: how strong to recommend?
Thread-Index: Acf/pLtyj1yaRiUITMGCv6jTRt9eYAAEUT4Q
From: "Anantha Ramaiah \(ananth\)" <ananth@cisco.com>
To: <mallman@icir.org>
X-OriginalArrivalTime: 25 Sep 2007 21:14:17.0361 (UTC) FILETIME=[081EB010:01C7FFB9]
DKIM-Signature: v=0.5; a=rsa-sha256; q=dns/txt; l=1574; t=1190754897; x=1191618897; c=relaxed/simple; s=sjdkim3002; h=Content-Type:From:Subject:Content-Transfer-Encoding:MIME-Version; d=cisco.com; i=ananth@cisco.com; z=From:=20=22Anantha=20Ramaiah=20\(ananth\)=22=20<ananth@cisco.com> |Subject:=20RE=3A=20[tcpm]=20tcpsecure=3A=20how=20strong=20to=20recommend ?=20 |Sender:=20; bh=OEkJinNEqlcJorIbT2taiai9dt+XLl2/b1b02qRzTE0=; b=SGDdekiH5V4Ut8azPU+eNKANmLu3r5Ke69vfBd5u6i/8XoaM6bB/Pte54ayaih1ZKt4xdH2Y QVZQTLwsUR4JD3N+7fDAuoeNHXBkj5HhDFbDLSb6Cqg2oyqInwHQD99i;
Authentication-Results: sj-dkim-3; header.From=ananth@cisco.com; dkim=pass ( sig from cisco.com/sjdkim3002 verified; );
X-Spam-Score: -4.0 (----)
X-Scan-Signature: 52e1467c2184c31006318542db5614d5
Cc: tcpm@ietf.org, David Borman <david.borman@windriver.com>, Fernando Gont <fernando@gont.com.ar>
X-BeenThere: tcpm@ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: TCP Maintenance and Minor Extensions Working Group <tcpm.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:tcpm@ietf.org>
List-Help: <mailto:tcpm-request@ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tcpm>, <mailto:tcpm-request@ietf.org?subject=subscribe>
Errors-To: tcpm-bounces@ietf.org

> 
> 
> Hat off ... 
> 
> This is a lot of hang wringing mumbo-jumbo, I think.  It 
> seems to me ...
> 
>   + If a standards track document says "a TCP SHOULD do X" then as a
>     particular TCP evolves it really ought to do X unless the
>     implementers have a very good reason not to do X.

Since, all these discussions about started due to TCP secure, let me use
the same as an example. There is nothing wrong in making all mitigations
SHOULD since the "very good reason" can be one of :-

- I don't care about security/robustness of TCP connections and hence my
products don't need to implement these.
- well I do care about security but I always use additional protection
like MD5 or IPsec and hence implementing this is optional. I'll think
about it.
- I like the mitigations in the draft and I see them lightweight and
I'll go ahead and implement them, but since these are tagged SHOULD I
may have a knob to control this behaviour.
- I definetely would want to implement these. Even though it is a
SHOULD, to me it is like a MUST.

So what I am tryng to say is: it is upto the implementers to interpret
and implement it if they wish to do so. Saying SHOULD is not an issue
since it gives enough leeway for all of the above scenarios.

But I am open to the idea of adding a generic applicability statement
like : "these mitigations are useful in blah blah... Conditions etc., "
Already if I remember correctly we do have some text to that effect in
the draft, but we can polish it further or formalize it.

-Anantha

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm