Re: [tcpm] RE: TCP secure

[Alfred Hönes <[e-mail]>]

Hello all,
I generally agree with the recent changes performed for
   draft-ietf-tcpm-tcpsecure-09,

yet in the newly added AS (Section 1.1),
the language should be improved based on the rationale below.

a) "The mitigations presented in" and "talks about" almost mean
   the same, but even worse, combined in the first line, the
   sentence does not parse.  Because "The mitigations" re-occurs
   in the next line, I suggest to drop the first occurrence.

b) "Solutions to .. [attacks]" does not seem to be very meaningful.
   I therefore also suggest to replace "the solutions to the same"
   by "suitable defenses against these".  Hopefully, this will
   increase the clarity, and add to the readability of the text.

c) "... devices where the TCP connections are most vulnerable ..."
   pretends to not admit the co-existence with less vulnerable
   TCP connections and the temporal variation over all the story.
   I suggest to talk about "... devices that regularly have to
   maintain TCP connections of the kind most vulnerable ...".

d) I also suggest to delete the subsequent "Some", because the
   following explanation only details *one* specific kind of TCP
   connections particularly vulnerable.

e) In the middle of the original paragraph, I suggest adding an "and"
   to make the syntax and semantics of the sentence unambiguous.

Taking that into account, I recommend changing:

OLD:

|  The mitigations presented in this document talks about some known in-
    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^          ~~~~~~~~~~~
|  window attacks and the solutions to the same.  The mitigations
                      ^^^^^^^^^^^^^^^^^^^^^^^^^
   suggested in this draft SHOULD be implemented in devices where the
                  vvvvv                                    ^^^^^^^^^^
   TCP connections are most vulnerable to the attacks described in this
   document.  Some examples of such TCP connections are the ones that
              ^^^^^
|  tend to be long-lived where the connection end points can be
                        ^
   determined, in cases where no auxiliary anti-spoofing protection
   mechanisms like TCP MD5 [RFC2385] can be deployed.  These mitigations
   MAY be implemented in other cases.

NEW:

|  This document talks about some known in-window attacks and suitable
|  defenses against these.  The mitigations suggested in this draft
|  SHOULD be implemented in devices that regularly need to maintain TCP
|  connections of the kind most vulnerable to the attacks described in
|  this document.  Examples of such TCP connections are the ones that
|  tend to be long-lived and where the connection end points can be
   determined, in cases where no auxiliary anti-spoofing protection
   mechanisms like TCP MD5 [RFC2385] can be deployed.  These mitigations
   MAY be implemented in other cases.


Kind regards,
  Alfred.

-- 

+------------------------+--------------------------------------------+
| TR-Sys Alfred Hoenes   |  Alfred Hoenes   Dipl.-Math., Dipl.-Phys.  |
| Gerlinger Strasse 12   |  Phone: [phone], Fax: -18         |
| D-71254  Ditzingen     |  E-Mail:  [e-mail]                     |
+------------------------+--------------------------------------------+



_______________________________________________
tcpm mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/tcpm