Table of Contents -> 2. Format of Entries
RFC 4949 Internet Security Glossary, Version 2 August 2007
1. Introduction
This Glossary is *not* an Internet Standard, and its recommendations represent only the opinions of its author. However, this Glossary gives reasons for its recommendations -- especially for the SHOULD NOTs -- so that readers can judge for themselves what to do.
This Glossary provides an internally consistent and self-contained set of terms, abbreviations, and definitions -- supported by explanations, recommendations, and references -- for terminology that concerns information system security. The intent of this Glossary is to improve the comprehensibility of written materials that are generated in the Internet Standards Process (RFC 2026) -- i.e., RFCs, Internet-Drafts, and other items of discourse -- which are referred to here as IDOCs. A few non-security, networking terms are included to make the Glossary self-contained, but more complete glossaries of such terms are available elsewhere [A1523, F1037, R1208, R1983].
This Glossary supports the goals of the Internet Standards Process:
o Clear, Concise, Easily Understood Documentation
This Glossary seeks to improve comprehensibility of security-
related content of IDOCs. That requires wording to be clear and
understandable, and requires the set of security-related terms and
definitions to be consistent and self-supporting. Also,
terminology needs to be uniform across all IDOCs; i.e., the same
term or definition needs to be used whenever and wherever the same
concept is mentioned. Harmonization of existing IDOCs need not be
done immediately, but it is desirable to correct and standardize
terminology when new versions are issued in the normal course of
standards development and evolution.
o Technical Excellence
Just as Internet Standard (STD) protocols should operate
effectively, IDOCs should use terminology accurately, precisely,
and unambiguously to enable standards to be implemented correctly.
o Prior Implementation and Testing
Just as STD protocols require demonstrated experience and
stability before adoption, IDOCs need to use well-established
language; and the robustness principle for protocols -- "be
liberal in what you accept, and conservative in what you send" --
is also applicable to the language used in IDOCs that describe
protocols. Using terms in their plainest, dictionary sense (when
appropriate) helps to make them more easily understood by
Shirey Informational [Page 3]
RFC 4949 Internet Security Glossary, Version 2 August 2007
international readers. IDOCs need to avoid using private, newly
invented terms in place of generally accepted terms from open
publications. IDOCs need to avoid substituting new definitions
that conflict with established ones. IDOCs need to avoid using
"cute" synonyms (e.g., "Green Book"), because no matter how
popular a nickname may be in one community, it is likely to cause
confusion in another.
However, although this Glossary strives for plain, internationally
understood English language, its terms and definitions are biased
toward English as used in the United States of America (U.S.).
Also, with regard to terminology used by national governments and
in national defense areas, the glossary addresses only U.S. usage.
o Openness, Fairness, and Timeliness
IDOCs need to avoid using proprietary and trademarked terms for
purposes other than referring to those particular systems. IDOCs
also need to avoid terms that either favor a particular vendor or
favor a particular security technology or mechanism over other,
competing techniques that already exist or might be developed in
the future. The set of terminology used across the set of IDOCs
needs to be flexible and adaptable as the state of Internet
security art evolves.
In support of those goals, this Glossary offers guidance by marking terms and definitions as being either endorsed or deprecated for use in IDOCs. The key words "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" are intended to be interpreted the same way as in an Internet Standard (i.e., as specified in RFC 2119 [R2119]). Other glossaries (e.g., [Raym]) list additional terms that deal with Internet security but have not been included in this Glossary because they are not appropriate for IDOCs.