Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Anantha Ramaiah (ananth) wrote:
>  
>> So to reiterate to the group, we need an applicability 
>> statement that highlights the 
>> implementations/deployments/applications that are RECOMMENDED 
>> to have this fix, with others being OPTIONAL. However, the 
>> features/changes themselves being MUST (or SHOULD, if that's 
>> what it would take for a consensus). Is the group in agreement here?
> 
> ++; 
> (with the author hat off :-)

As a way forward, the following captures the SHOULD/SHOULD/MAY which was
 most supported in Chicago:

---------------------------------------------------------------------------

tcpsecure SHOULD be implemented in TCP stacks supporting router.
Notable exceptions include deployments where routers are known to use
other antispoofing protection, e.g., IPsec, TCP/MD5 and its successors.

tcpsecure MAY be implemented in other TCP stacks.

----
within tcpsecure:

RST protection MUST be supported

SYN protection MUST be supported

data segment (i.e., non-RST, non-SYN) protection MAY be supported

-------------------------------------------

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm