What shall we do about draft-ietf-msdp-spec's security considerations?
I'd like to make Keyed MD5 a MUST; Alex says that many implementations
don't have even that. If it were standards track, there'd be no
question -- we block the I-D until they get it right. This is
Experimental. Do we require a MUST, even though that's not real?
(Does MUST mean anything for Experimental?)
I think that the question partly turns on the community's intentions
for MSDP. Are we trying to build on it? If so, require MUST. Is this
just documenting an evolutionary dead end? If so, get rid of the MUSTs
from the security considerations, and in fact rewrite to to say "some
implemtations use 2385, some don't; here are the evil things that can
happen if there's inadequate authentication and/or confidentiality, and
here are the authorization requirements". (That would be good to say
in any event.)
I think we're documenting an evolutionary dead end. But I think we don't
have a replacement ready at the moment, so we're going to live with it for
a while too.