Re: [tcpm] tcpsecure: how strong to recommend?

[Joe Touch <[e-mail]>]

Anantha Ramaiah (ananth) wrote:
> Inline comments....
...
> - Like someone pointed out MAY is a weak statement, it could also imply
> "MAY not". Why should it be a MAY when we know that the pros of the
> soultion outweigh the cons?

They do not in all cases. If TCP is deployed either where no well-known
connections exist, or where such connections are protected by other
authentication, this solution adds
	a) complexity
	b) chatter during valid RSTs
	c) IPR encumberance

> - to me these recommendations are good to have, 

You're now making decisions for others, i.e., these recommendations are
"good for everyone to have unless they have a reason not to". That's not
what you said before in terms of "let the user/implementer decide".

...
>> There's no MUST in that logic, any more than 'you MUST deploy 
>> IPsec/BTNS/TCP-MD5++'.
> 
> I am assuming it is a conditional MUST like "if you need security then
> use TCP MD5", correct? Is "conditional MUST = SHOULD" ?

It is a conditional SHOULD, i.e., a SHOULD with a caveat. From the
RFC2119-level, IMO that's a MAY with explanation.

Joe

_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm