Subject: RE: [Isms] Revised TLS proposal

From: "Fleischman, Eric" <[email-masked]>
Date: Thu, 4 Nov 2004 17:32:51 -0800

Hmm. If we were talking about using TLS for ISMS, I agree with you, Wes,
that it must use mutual authentication. However, if we are seeking to
require that ISMS must use TLS, then I would disagree. From where I sit,
I am by no means convinced that TLS is the best alternative for us to
pursue. Please note that I am not saying that it isn't. I am only saying
that I am far from convinced that it is.

-----Original Message-----
From: Wes Hardaker [mailto:[email-masked]] 
Sent: Thursday, November 04, 2004 5:20 PM
To: [email-masked]
Cc: [email-masked]
Subject: Re: [Isms] Revised TLS proposal

>>>>> On Thu, 4 Nov 2004 18:30:20 -0500, "David B Harrington" 
>>>>> <[email-masked]> said:

David> The TLS TM-security model SHOULD use the TLS Handshake Protocol 
David> with mutual authentication.

[I'm assuming at least auth here for the sake of the following
discussion]

IMHO, this should be a MUST.  Doing anything less is actually arguably
less secure than USM, which authenticates both sides (admittedly with
the same key, but both sides can be proven to be the correct
correspondence assuming no compromise has taken place).  With your above
statement, it means that no equal confidence can be made when using TLS.

-- 
Wes Hardaker
Sparta

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms