Lots of HN criticism on the draft. Hopefully the authors find it for the next iteration. On the positive side, I would use something like this when I have one

Lots of HN criticism on the draft. Hopefully the authors find it for the next iteration. On the positive side, I would use something like this when I have one of: • A service that is resource intensive to start and reject a connection. Reduce the impact of brute forcers. • A service I do not trust. Sometimes politics or expediency will place a service on a public port which may or may not have catastrophic security flaws of which you are not aware but the vendor is committed to addressing in "6 months". • Brute force attacking results in noisy logs or some other annoyance and there isn't an easy option to address it. If I have one of those cases AND the service is only accessed from a limited number of remote hosts I would adjust the firewall to only allow the proper hosts to connect. TCP Stealth would let me move that authentication from the firewall administrator to a set of trusted people to whom I give the shared secret. This lets those people address the case where the client's IP changes or they need to come in from a different machine. Think of it as a portable hole through the firewall. For the server, I think it might best be implemented as a rule in the firewall, say on Linux… iptables -A INPUT -p tcp --dport 7 -m stealth --stealth-secret fi9…6g -j ACCEPT … this means no changes to your servers, of which you may not have control, and you can apply it to forwarded connections for machines hiding behind your firewall. You could also have a socket option the server sets and handle it in the TCP stack. Client side implementation is murkier to me. There could be a socket option the client sets, but then you need to remake all the clients, and some of them will be your web browser. You could do something at the TCP stack level to map certain hosts and ports to secrets. That seems strange too. I'm not sure a firewall rule works for the client, it would have to communicate a sequence number back to the TCP stack or forever be translating them.