Re: [tcpm] tcp-security: More feedback requested for the document outline

[Fernando Gont <fernando at gont.com.ar>]

Hi, Joe,

> It also distinguishes between protocol weaknesses (places where the
> protocol creates a vulnerability, regardless of implementation - e.g.,
> ICMP attacks), implementation choice issues (places where a choice left
> to implementers can cause problems if poorly chosen - e.g., how some
> SHOULDs turn into "don't do this in a secure implementation"), and
> implementation vulnerabilities (implementation issues not related to
> choices in the spec that create problems - e.g., searching the TIME-WAIT
> list linearly).
> 
> Regardless of how we proceed, I believe that this latter issue should be
> considered in the presentation of solutions.

Yes. I think somebody else (David Borman?) already raised this issue.

As we start discussing the technical stuff, I will make sure it is clear
whether it's a protocol issue, an implementation issue, etc., whether
the specs mandate the behavior as a MUST, SHOULD (or whatever), and
whether the countermeasures comply with the specs or go against them.

Thanks!

Kind regards,
-- 
Fernando Gont
e-mail: fernando at gont.com.ar || fgont at acm.org
PGP Fingerprint: 7809 84F5 322E 45C7 F1C9 3945 96EE A9EF D076 FFF1