Subject: RE: Storage over Ethernet/IP

From: "Dawson, Peter D" <[email-masked]>
Date: Mon, 29 May 2000 17:02:10 -0000

->-----Original Message-----
->From: Harald Tveit Alvestrand [mailto:[email-masked]]
->Sent: Friday, May 26, 2000 6:27 PM
->To: [email-masked]
->Cc: [email-masked]
->Subject: RE: Storage over Ethernet/IP 

->The point being made, remade and made again here is:
->- Any protocol that offers no means of countering such 
->security threats is 
->broken, and should not be considered for standardization.

->It is perfectly possible that after conducting a threat and modality 
->analysis, one ends up with saying that hardware-accelerated 
->IPsec using 
->host identities is adequate for the scenarios involving 
->otherwise-unprotected Internet links, and that a mode with no 
->protection is 
->adequate when the media is physically secured.
->
->But the analysis MUST BE DONE.
->

is vulnerability and threat analysis part of the 
standardization process ??

/pd

---

From: Keith Moore <[email-masked]>
Date: Mon, 29 May 2000 14:42:23 -0400

> standardization process ??

yes.

---

From: "RL 'Bob' Morgan" <[email-masked]>
Date: Mon, 29 May 2000 22:49:10 -0700 (PDT)

> is vulnerability and threat analysis part of the standardization
> process ??

RFCs 2251-2256, which specify LDAPv3, carry a stern warning up front that
that these documents lack a standard mandatory-to-implement strong
authentication method, hence limiting the applicability of the protocol
(how much effect this warning has had in practice is hard to say, of
course).  New documents have been written that do indeed do a
vulnerability analysis, not in any great depth but enough to motivate the
mechanisms recommended to deal with the identified threats.  In particular
see RFC 2829 (which should appear any minute now,
draft-ietf-ldapext-authmeth-04.txt in the mean time).

 - RL "Bob"