Re: FW: [Entmib] Minutes from SF (fwd)

[Russ Housley <housley@vigilsec.com>]

Harald:

> > > By the same logic, all the MAYs must be implemented or removed too.
> > I think this is raising the bar above current practice.
> You're probably right. But it still leaves the question of whether these 
> features are specified enough for interoperable implementations hanging. 
> Which is not a Good Thing.
>
> For one example of such features being tested:
>
> http://www.ietf.org/IESG/Implementations/http1.1-implementations.txt
>
> For instance, Accept-Ranges: is not a MUST or SHOULD feature.
I think that both MUST and SHOULD requirements ought to be included in 
interoperability testing.  However, I think that MAY is going too 
far.  Consider the following:

        Implementations MUST support Triple-DES.
        Implementations SHOULD support AES.
        Implementations MAY support any other algorithms as well.

I would like to see two implementations of Triple-DES and AES.  The rest is 
too open ended.

Russ