Subject: [tcpm] Re: strength of tcpsecure recommendation

From: Mark Allman <[email-masked]>
Date: Fri, 13 Apr 2007 10:29:34 -0400

Folks-

I have not seen any input to the following query.  We really need some
so we can move forward.  In particular, we didn't even hear from the
folks who have been discussing the issue.  I would very much appreciate
it if you could take a few minutes to answer the poll.

Thanks,
allman

> Folks-
> 
> I'd like to try to be a bit systematic about figuring out how to proceed
> with the tcpsecure i-d and so I have cooked a poll below.  The essential
> questions on the table is the mitigations ought to be labeled as SHOULD
> or MAY and whether these labels ought to be conditioned or not.
> 
> We have had some good conversation on the topic and lots of points have
> been aired (how baked these solutions are, IPR, cost v. benefit, etc.).
> So, I am asking that the answers to the following questions be succinct
> and not rehash a bunch of previous argument.  If you feel you have a
> **new** point then that is clearly fine.
> 
> I am trying to get a good read of the WG here and so even if you have
> clearly aired opinions before, please take the minute and answer these
> questions.
> 
> (Note that SHOULD and MAY are clearly not the only choices.  If you want
> to vote for MUST or MUST NOT then that is fine, even though they are not
> listed as choices below.  If you do, please then do provide some
> justification.)
> 
> The questions then ...
> 
> (1) (a) Do you believe the draft should allow the "blind reset attack
>         using the RST bit" mitigation described in section 3 of the
>         document as a SHOULD or a MAY?
> 
>     (b) Should we apply a condition to the recommendation?  If so,
>         please state the condition you'd like to see very succinctly.
> 
> (2) (a) Do you believe the draft should allow the "blind reset attack
>         using the SYN bit" mitigation described in section 4 of the
>         document as a SHOULD or a MAY?
> 
>     (b) Should we apply a condition to the recommendation?  If so,
>         please state the condition you'd like to see very succinctly.
> 
> (3) (a) Do you believe the draft should allow the "blind data injection
>         attack" mitigation described in section 5 of the document as a
>         SHOULD or a MAY? 
> 
>     (b) Should we apply a condition to the recommendation?  If so,
>         please state the condition you'd like to see very succinctly.
> 
> Thanks in advance for the input!
> 
> allman

_______________________________________________
tcpm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tcpm