Discuss additional topics in Security Considerations

[rohanmahy]

• using ordinary and deterministic eliminate some avenues for exfiltrating data that is invisible to the attackers
  • based on indefinite length choices - very powerful
  • based on specific encoding chosen
  • based on order of maps
• using ordinary or deterministic encoding eliminates some categories of resource exhaustion attacks

[laurencelundblade]

1. The critical security considerations would be NEW ones that come into play because of the NEW things this draft defines over and above RFC 8949. I don't think there are any of these because we already have preferred and 4.2.1 in RFC 8949.

2. If we have come to understand new threats that apply to 8949, then they should be errata for 8949, a separate document or if in this document framed as an update to 8949 security considerations. The threats you mention seem to be in this category.

3. I'm a security considerations minimalist (but of course will go with consensus).

4. I'm probably not the person to write these up.