Subject: [Isms] Revised TLS proposal

From: "David B Harrington" <[email-masked]>
Date: Thu, 4 Nov 2004 18:30:20 -0500

Hi,

I posted this revison yesterday, but it is in the queue for posting
approval because I used a different email address.
Let's try this address instead.

David Harrington
[email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Wes Hardaker <[email-masked]>
Date: Thu, 04 Nov 2004 17:19:49 -0800

>>>>> On Thu, 4 Nov 2004 18:30:20 -0500, "David B Harrington" <[email-masked]> said:

David> The TLS TM-security model SHOULD use the TLS Handshake Protocol
David> with mutual authentication.

[I'm assuming at least auth here for the sake of the following discussion]

IMHO, this should be a MUST.  Doing anything less is actually arguably
less secure than USM, which authenticates both sides (admittedly with
the same key, but both sides can be proven to be the correct
correspondence assuming no compromise has taken place).  With your
above statement, it means that no equal confidence can be made when
using TLS.

-- 
Wes Hardaker
Sparta

---

From: "David B Harrington" <[email-masked]>
Date: Mon, 8 Nov 2004 14:14:34 -0500

The SHOULD refers to using the specific protocol, with the specific
level of authentication. It is my understanding that the TLS Handshake
Protocol is one option for atuthentication, which might be superceded
in the future, so it can only be a SHOULD. I have no difficulty
requiring mutual authentication when TLS Handshake is used. 

dbh

> -----Original Message-----
> From: Wes Hardaker [mailto:[email-masked]] 
> Sent: Thursday, November 04, 2004 8:20 PM
> To: [email-masked]
> Cc: [email-masked]
> Subject: Re: [Isms] Revised TLS proposal
> 
> IMHO, this should be a MUST.  Doing anything less is actually 
> arguably less secure than USM, which authenticates both sides 
> (admittedly with the same key, but both sides can be proven 
> to be the correct correspondence assuming no compromise has 
> taken place).  With your above statement, it means that no 
> equal confidence can be made when using TLS.
> 
> --
> Wes Hardaker
> Sparta
>