Subject: Re: Addition for Section 11

From: Jeffrey Altman <[email-masked]>
Date: Mon, 7 Oct 2002 16:12:53 EDT

> >In my opinion, we have an obligation, both as security protocol designers
> >and under the IESG mandate that all standards-track documents discuss
> >security considerations, to point out this fact so that potential users of
> >the protocol do not inadvertently leave themselves vulnerable to this
> >attack.
> 
> We're in violent agreement here, aren't we?  I mean, I was one of the
> people who thought up this crazy scheme, and _I_ think we should include
> a detailed warning explaining the vulnerabilies you can encounter when
> using this protocol.  Is anyone saying that we shouldn't?
> 
> --Ken
> 

My only objection was to the use of "MUST NOT" along with the
explanation.

 Jeffrey Altman * Sr.Software Designer     Kermit 95 2.0 GUI available now!!!
 The Kermit Project @ Columbia University  SSH, Secure Telnet, Secure FTP, HTTP
 http://www.kermit-project.org/            Secured with MIT Kerberos, SRP, and 
 [email-masked]               OpenSSL.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Mon, 07 Oct 2002 15:19:59 -0500

> My only objection was to the use of "MUST NOT" along with the

Should it be should not?

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444