Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Notes below....

Anantha Ramaiah (ananth) wrote:
>> As a way forward, the following captures the 
>> SHOULD/SHOULD/MAY which was
>>  most supported in Chicago:
>>
>> --------------------------------------------------------------
>> -------------
>>
>> tcpsecure SHOULD be implemented in TCP stacks supporting router.
>> Notable exceptions include deployments where routers are known to use
>> other antispoofing protection, e.g., IPsec, TCP/MD5 and its 
>> successors.
>>
>> tcpsecure MAY be implemented in other TCP stacks.
>>
>> ----
> 
> 
>> within tcpsecure:
>>
>> RST protection MUST be supported
>>
>> SYN protection MUST be supported
>>
>> data segment (i.e., non-RST, non-SYN) protection MAY be supported
>>
>> -------------------------------------------
> 
> I think you got it wrong. 
> 
> Most supported in Chicago was about [SHOULD/SHOULD/MAY] WITHOUT the
> applicability statement in place.

Agreed. I was trying to capture Chicago in the bottom portion.

> It was "STANDALONE" question raised by
> the chairs for which the consensus seemed to be in favour of S/S/M.  Now
> WITH the applicability statement in place, it completely changes the
> entire equation. 

I don't think it does. Even with a qualified SHOULD on the overall set,
data segment protection is still a MAY. What it changes is the SHOULDs
on the RST and SYN to MUSTs, to say that you shouldn't implement one or
the other as desired *if* you decide to implement the set.

...
> So, the game plan moving forward is, to generate the AS and revisit the
> mitigation strengths. 

I tried to do that above.

> Also, just in case you missed, some of responses
> in this list have indicated no issues with "MUST'ing" all the
> mitigations provided there is a proper applicability statement in place.

I know - that was one of the set discussed. OK, so here's what I'm
specifically asking:

1) is the AS above reasonable?

2) regarding the RST/SYN/data components:
	- are the MUST/MUST/MAY above reasonable?
	- Or should they be SHOULD/SHOULD/MAY?
	- or something else

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm