Re: [tcpm] tcpsecure recommendations

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Given the AS's statement below:
|     ... TCP secure MAY
|     (OPTIONAL) be implemented in other cases.
|
| We can recommend each of mitigations with a MAY, SHOULD or MUST.  In
| Chicago we winnowed the proposals to three three:

#3 makes most sense tm oe. #1 weakens the AS statement too much, and #2
covers data plane protection that there are too many other ways to spoof
(overwriting segments, or just writing segments with predicted header
data). This appears to be best applied to an unauthenticated control plane.

Joe

|     (1) RST spoofing mitigation: MAY
|         SYN spoofing mitigation: MAY
|         data injection mitigation: MAY
|
|     (2) RST spoofing mitigation: SHOULD
|         SYN spoofing mitigation: SHOULD
|         data injection mitigation: SHOULD
|
|     (3) RST spoofing mitigation: SHOULD
|         SYN spoofing mitigation: SHOULD
|         data injection mitigation: MAY
|
| Nobody has advocated for other permutations of recommendations
| (although, clearly if people like some different combination they should
| advocate away!).
|
| Can folks please weigh in on their feeling about how strongly we should
| recommend these mitigations given the AS above?  It'd be great to get
| this document moving and we're sort of stuck here.
|
| Thanks,
| allman
|
|
|
|
|
| ------------------------------------------------------------------------
|
| _______________________________________________
| tcpm mailing list
| tcpm@ietf.org
| http://www.ietf.org/mailman/listinfo/tcpm
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFHqyk9E5f5cImnZrsRAsi5AJ942eMHdpBGM7b1sU1N/YZKlfeSUwCgk9II
5mp3ZMUODozwLLajVqB+w3g=
=qo2i
-----END PGP SIGNATURE-----
_______________________________________________
tcpm mailing list
tcpm@ietf.org
http://www.ietf.org/mailman/listinfo/tcpm