Re: [tcpm] Secdir last call review of draft-ietf-tcpm-rfc793bis-24

[Wesley Eddy <[e-mail]>]

Some proposals on how to address the SECDIR last call comments:

On 7/30/2021 5:30 PM, Kyle Rose wrote:
> > The one item I see missing from this section is a mention of lessons 
> learned
> > and subsequently applied to the design of QUIC. I think it is worth 
> mentioning,
> > for instance, that TCP's large surface area of cleartext metadata 
> exposes more
> > information to the path than required to successfully route packets 
> to their
> > destination, including to on-path adversaries that may be able to 
> use this
> > metadata to bolster targeted or pervasive surveillance.

It looks like this is covered pretty well in RFC 8546, which you mention 
below, so I think it might suffice for 793bis to just add a sentence 
noting pretty much exactly what you said above and referring interested 
readers to RFC 8546.


> > There is one more omission, adjacent to (but not explicitly about) 
> security,
> > that I think warrants some text in this document: that is around 
> ossification.
> > Given the lengthy back-and-forth I witnessed as chair of the TCPINC WG
> > regarding the (in)feasibility of protecting segmentation and header 
> values on
> > the public internet, it is probably worth adding to a 793bis 
> document a section
> > that briefly outlines the ossification impact of voluminous 
> cleartext and
> > unprotected/un-GREASEd metadata, maybe with a reference to the wire 
> image as
> > defined by RFC 8546. The reason I think this is worthwhile is that 
> it would be
> > good to have the practical limits of TCP extensibility (i.e., in a 
> world with
> > middleboxes and other deeply TCP-aware network elements) documented 
> where folks
> > might look for it when thinking about new options or other new 
> functionality. I
> > would be happy to help flesh out some text here.

I don't really want to add a whole section for this, since we aren't 
going to actually change anything, however, I think it makes sense to 
add the above-mentioned reference to 8546, plus a little bit more 
expansion that references RFC 8558 as having additional recommendations 
that could be applied with regard to future TCP extensions.

If this sounds okay, I can add a couple of sentences to the draft.