Subject: [Speechsc] Default support for TLS?

From: "Carter, Jerry" <[email-masked]>
Date: Thu, 16 Mar 2006 14:13:16 -0500

I've been trying to understand the origin of the language in section 12.2:

    To ensure control channel protection, MRCPv2 clients
    and servers MUST support TLS and SHOULD utilize it
    by default.  Alternative control channel protection
    MAY be used if desired (e.g. IPSEC).

I understand the need for TLS support as a technique for addressing security
concerns in many environments.  TLS is a good thing.  But, I do not
understand why TLS defaults to 'ON'.  

Looking back at the minutes from summer 2004 (e.g.
http://www1.ietf.org/mail-archive/web/speechsc/current/msg00888.html
<http://www1.ietf.org/mail-archive/web/speechsc/current/msg00888.html> )
when TLS was added, I cannot find anyone arguing for this default value.
Looking at the emails between drafts 6 (where TLS was not the default) and 7
(when TLS became the default), I can't find anyone arguing for this change.
When did the SpeechSC group agree to this?

I am concerned here because the majority of telephony deployments, the MRCP
server and client are running on the same trusted network.  In many cases,
the cpu & latency costs for performing an unnecessary encryption step are
desired.  For these buyers, using TLS by default is a barrier for
deployment.

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc

---

From: David R Oran <[email-masked]>
Date: Thu, 16 Mar 2006 14:23:53 -0500

On Mar 16, 2006, at 2:13 PM, Carter, Jerry wrote:

> I’ve been trying to understand the origin of the language in  
> section 12.2:
>
>
>
>     To ensure control channel protection, MRCPv2 clients    and  
> servers MUST support TLS and SHOULD utilize it    by default.   
> Alternative control channel protection    MAY be used if desired  
> (e.g. IPSEC).
>
>
> I understand the need for TLS support as a technique for addressing  
> security concerns in many environments.  TLS is a good thing.  But,  
> I do not understand why TLS defaults to ‘ON’.
>
>
So that:
a) the protocol meets the requirements laid out in the SPEECHSC  
requirement security considerations section
b) so that deployed systems using speechsc are secure by default -  
you have to turn it off explicitly if you don't want it.

Experience has shown that people don't turn on security unless they  
either very knowledgeable or have been attacked successfully.

> Looking back at the minutes from summer 2004 (e.g. http:// 
> www1.ietf.org/mail-archive/web/speechsc/current/msg00888.html) when  
> TLS was added, I cannot find anyone arguing for this default  
> value.  Looking at the emails between drafts 6 (where TLS was not  
> the default) and 7 (when TLS became the default), I can’t find  
> anyone arguing for this change.  When did the SpeechSC group agree  
> to this?
>
>
I'm not sure if there was an explicit WG consensus call on this, but  
the IESG security Area directors held up the requirements doc for  
more than a year over such issues.

> I am concerned here because the majority of telephony deployments,  
> the MRCP server and client are running on the same trusted  
> network.  In many cases, the cpu & latency costs for performing an  
> unnecessary encryption step are desired.  For these buyers, using  
> TLS by default is a barrier for deployment.
>
>
So, turn it off. Better to be slow and secure out of the box than  
fast and insecure.

Dave. (chair hat on).