Subject: [tcpm] regarding upcoming tcpcrypt presentation

From: Joe Touch <[email-masked]>
Date: Thu, 13 Feb 2014 13:00:26 -0800

Since this is the second (at least - maybe third) time this concept will 
be presented to the IETF, it might be useful to at least consider 
addressing comments that go back around 3 years:

1) the posted code still codepoint-squats:

> ...it appears to use *two* unassigned TCP option codepoints
> (69 and 70), rather than experimental codepoints (and, IMO, it should
> use the latter instead).

The doc should use the experimental codepoints with registered ExIDs, as 
per RFC6994

2) The MAC aspect is redundant with TCP-AO, and it might even be 
reasonable to consider extending TCP-AO to support encryption in 
addition to authentication using a single system.

> TCP-AO could easily support a mode where the TCP body was encrypted,
> e.g., where the encryption algorithm were defined to use the
> connection context (TCP header, IP pseudoheader) as context.

3) the description of the protocol itself is insufficient

The draft does not link sufficiently to the description of TCP states 
and processing options in those different states, or to the order of 
option processing.

Joe