Subject: [Crisp] draft-newton-crisp-iris-xpc-00.txt

From: Andrew Newton <[email-masked]>
Date: Thu, 10 Feb 2005 18:09:53 -0500

Hola crispy critters,

I've recently submitted a new draft 
(draft-newton-crisp-iris-xpc-00.txt) about a new TCP transport-binding. 
  It is complimentary in structure to the LWZ draft.  Here's the URI: 
http://www.ietf.org/internet-drafts/draft-newton-crisp-iris-xpc-00.txt

I've already received one private comment regarding it.  In summary, 
the suggestion was to eliminate the raw TCP aspect and strictly use 
TLS, having clients specify SSL_NULL_WITH_NULL_NULL cipher suite when 
no encryption is needed.  The thought is that this reduces complexity 
and will not be that big of an overhead for servers considering it is 
desirable to have most traffic flow over UDP (LWZ) when no auth is 
needed.

As usual, thoughts and comments are welcome.

-andy

_______________________________________________
Crisp mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/crisp

---

From: George Michaelson <[email-masked]>
Date: Fri, 11 Feb 2005 09:35:18 +1000

is there a risk that users will be lulled into a false sense of security
e2e if the transport 'claims' to be TLS, but is using a null crypto?

Otherwise, its a rational choice I guess, and avoids the issue of having to
think about two transport platforms.

-G

---

From: Andrew Newton <[email-masked]>
Date: Thu, 10 Feb 2005 20:55:39 -0500

> e2e if the transport 'claims' to be TLS, but is using a null crypto?

I'm thinking that perhaps the advice in the draft is to use the null 
cipher suit unless the user explicitly asks for encryption or plain 
passwords are being used.  And to avoid what you have mentioned, 
clients should be instructed to differentiate between TLS with 
encryption and TLS without encryption.

> think about two transport platforms.

Yup.  Less admin trivia (ACLs on border routers, firewall rules, etc... 
) too.

-andy