Re: [tcpm] tcp-security: Request for feedback on the outline of the document

[Fernando Gont <[e-mail]>]

Hello, Toby,

> opinions on this document that are clearly incompatible. One key thing,
> regardless of how we actually decide to split the work, Fernando's
> current ToC is too long... 3 pages of ToC is excessive. 

Well, it's a large document. Even If we reduce the number of top-level
sections, the ToC would most likely still be that large (or it wouldn't
be useful).


> I think the
> sections aren't grouped at a high enough level (e.g. connection
> establishment and tear-down could be in one section on connection
> management, buffer management and re-assembly could probably be grouped
> into memory management, etc). 

I agree. Please let me have another look, and try to come up with something.


> This is separate to any consideration as
> to whether you should be presenting things in a completely different
> order... I think Joe actually raised this before...

I don't think this is what Joe raised. For the most part, he argued to
organize the information on a per-attack-type basis. Anyway, you did
raise it... so,.. point taken.



>> Again: the goal of this document is helping TCP implementers harden
>> their TCPs. And for that target, having everything about a protocol
>> field in a single place is the only document outline that does not get
>> in the middle of the developer and the implementation. If you spread
>> the
>> advice among lots of places, this is what will happen: some
> mitigations
>> will be missed.
> 
> So if this is entirely aimed at implementers shouldn't that be
> explicitly stated in the title? I appreciate that in theory BCP is meant
> to imply implementation guidance but this might be more appropriately
> titled something like "Implementers guidelines for mitigating TCP
> security threats" or "Guidance on secure implementation of TCP"

Point taken. How about "Guidance on secure implementation of the
Transmission Control Protocol (TCP)"?

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: [e-mail] || [e-mail]
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1