RE: [tcpm] tcpsecure: how strong to recommend?

> 
> 
> Anantha Ramaiah (ananth) wrote:
> > Few points :-
> > 
> > - It is true that TCP secure recommendations might be 
> useful for long 
> > lived sessions like BGP. But there are many applications using TCP 
> > which also could benefit from the proposed changes.
> 
> As an aside, it would be useful to provide in your doc an 
> example of such an application, e.g., where the endpoints and 
> port numbers are known or reasonably guessable.

We can give it a thought about adding something if the WG feels so. I
for one feel that we would want to preserve the generic nature of this
document, you want to avoid listing application references as much as
possible, we can give examples but as you it wouldn't be a complete
list, anyways.

> 
> > The TCP secure changes
> > needs to be viewed as a standalone thing, since it focusses in 
> > providing robustness to TCP connections w.r.t some spoofing attacks.
> 
> The real point is that spoofing isn't a standalone thing. 
> Putting protections into TCP without locking down ICMP isn't 
> sufficient, and inferring authentication from header 
> properties just narrows the window of attack.

If we have to fix multiple layers, lets fix it, I have no problems. You
can do all at once or piecemeal, as simple as that. It doesn't matter
whether spoofing is standalone or not, it is about how well you can make
your TCP stack respond to such malicious attacks, if you care to do so.

> 
> > - TCP secure, TCP MD5, TCP advanced security algorithms, 
> IPsec are all 
> > different tools with varying degrees of complexity and 
> usage. A user 
> > can chose to use one of them depending on his/her requirements. 
> > Telling people to only use IPsec is akin to saying "always fly in 
> > business class". Yes I have used this analogy before, but 
> this is one 
> > whih popped up in mind after today's coffee :-)
> 
> If we agree that users should be able to choose the solution 
> that fits, let's go with MAYs all around.

I know you want all MAY's in place. Some others (includes me) are not
yet convinced that why SHOULD doesn't provide the same assurance.

> 
> Otherwise, aren't you dictating your solution as fitting 
> everyone's needs?

I am not "dictating" anything here. I am just supporting the reason why
I feel it should be SHOULD's :-) 

-Anantha
> 
> Joe
> 
> 

_______________________________________________
tcpm mailing list
tcpm@ietf.org
https://www1.ietf.org/mailman/listinfo/tcpm