This result enables the testable hypothesis that the historical lack of mandatory security requirements in early RFCs correlates with a higher rate of modern protocol vulnerabilities in legacy-dependent TLS implementations compared to those designed under strict security-mandated RFCs.

[THE CLAIM AS ORIGINALLY STATED — TESTED 27 Aug 2026 AND FOUND UNFALSIFIABLE WITH PUBLIC DATA. Retained verbatim as the record of what was under test, not as a live prediction.]

Among a corpus of IETF RFCs published before 1999 (pre-TLS 1.0, pre-mandatory-security-consideration era, i.e., before RFC 2223/2316-era security review norms) versus RFCs published after 2003 (post RFC 3552 "Guidelines for Writing RFC Text on Security Considerations"), protocols/implementations whose specification lineage traces to the pre-1999 cohort will exhibit a statistically significant higher rate of CVEs classified as protocol-design-level vulnerabilities (not implementation-bug-level, e.g., CWE-327, CWE-295, CWE-326) per protocol-year of deployment in modern TLS-dependent software (OpenSSL, BoringSSL, GnuTLS, wolfSSL, mbedTLS, Schannel, Java JSSE), controlling for codebase size, deployment prevalence, and audit frequency, at a threshold of Cohen's d ≥ 0.5 and p < 0.01 after multiple-comparison correction.

[SUPERSEDED 27 Aug 2026 — TESTED, NOT EXECUTABLE. See analysis/rfc_security/RESULT.md] This protocol cannot be run. Step 1 (define two cohorts by publication date, then control for age) is self-contradicting: RFC 3552 IS a date, so cohort membership and publication date are the same variable. 9 of 10 five-year strata contain only one cohort, so stratifying discards 87% of the corpus and leaves no contrast.

ORIGINAL: Retrospective observational cohort study (quasi-experimental, since RFC era cannot be randomized) using historical CVE/NVD data, RFC metadata, and codebase archaeology.

1. Define two RFC cohorts by publication date and explicit security-consideration mandate status (pre-1999 no-mandate vs. post-RFC-3552 mandate-compliant, 2003+).
2. Map each cohort to concrete protocol versions/cipher suites/extensions.
3. Identify all CVEs (2000–2024) in six major TLS implementations tagged to each protocol feature via commit-message/changelog cross-referencing and NVD CPE mapping.
4. Classify each CVE as "design-level" vs "implementation-level" via CWE taxonomy + manual review (2 raters, Cohen's kappa ≥ 0.7 required).
5. Normalize by feature-years-deployed and by codebase LOC associated with that feature (extracted via git blame/archaeology).
6. Run mixed-effects regression (vulnerability rate ~ RFC_era + prevalence + audit_frequency + (1|implementation)).
7. Report effect size, confidence intervals, and sensitivity analysis excluding Heartbleed-class outliers.

1. rfc_corpus = fetch_ietf_datatracker(range=1996-2010)
2. cohort_labels = classify_security_mandate(rfc_corpus, rule=RFC3552_criteria)
3. feature_map = build_crosswalk(rfc_corpus, protocol_features=TLS_SSL_features)
4. cve_data = query_nvd(cpe_list=[openssl, boringssl, gnutls, wolfssl, mbedtls, jsse])
5. tagged_cves = match_cves_to_features(cve_data, feature_map, method=NLP+manual_sample)
6. cwe_labels = dual_rate_classify(tagged_cves, raters=2, scheme=design_vs_impl)
   assert cohen_kappa(cwe_labels) >= 0.7
7. loc_data = git_archaeology(repos, features=feature_map)
8. prevalence = fetch_censys_historical(features=feature_map)
9. df = merge(tagged_cves, loc_data, prevalence, cohort_labels)
10. df['norm_rate'] = df.design_cves / (df.feature_years * log(df.loc))
11. model = mixedlm("norm_rate ~ rfc_era_cohort + prevalence + audit_freq",
                     groups=df.implementation).fit()
12. sensitivity = leave_one_out(model, groups=[implementations, high_leverage_cves])
13. report(effect_size, ci_bootstrap, sensitivity, kappa)