Subject: RE: [TLS] Re: Two notes on TLS 1.2 after implementing it in GnuTLS

From: Peter Williams <[email-masked]>
Date: Sun, 10 Dec 2006 08:48:38 -0800

"OpenVPN actually runs TLS over UDP byimplementing a reliability layer for the TLS control channel.  TLS is a fairlystrong, well regarded protocol, easily accessible using the OpenSSL library,and it seems to be the obvious choice for initial authentication and keyexchange. "http://sites.inka.de/bigred/archive/cipe-l/2003-09/msg00263.html
Is this still true? I'm proud of the designers who did this, if its true. They "got it' - the security architecture, that is.GnuTLS work for TLS1.2-era should make efforts to replicate the architecture, and ensure the SSL/TLS record layer is not bound to TCP.
 
That is not to say that the embodiment of the SSL2/TLS fragmentation/reassembly functions in the record (+ SSL2 escape or TLS1.1 custom record type escapes for OOB) should be tied to the nature of the network media - but that the stack API (sockets or libraries) should NOT assume anything about the nature of TCP, in theory or practice.
_________________________________________________________________
Use Messenger to talk to your IM friends, even those on Yahoo!
http://ideas.live.com/programpage.aspx?versionId=7adb59de-a857-45ba-81cc-685ee3e858fe

_______________________________________________
TLS mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/tls

---

From: [email-masked] (Peter Gutmann)
Date: Mon, 11 Dec 2006 06:11:21 +1300

Peter Williams <[email-masked]> writes:

>"OpenVPN actually runs TLS over UDP byimplementing a reliability layer for
>the TLS control channel.  TLS is a fairlystrong, well regarded protocol,
>easily accessible using the OpenSSL library,and it seems to be the obvious
>choice for initial authentication and keyexchange. "
>http://sites.inka.de/bigred/archive/cipe-l/2003-09/msg00263.html

In a nutshell what OpenVPN does is use TLS for the handshake and IPsec's ESP
for the UDP transport.

>Is this still true? I'm proud of the designers who did this, if its true.
>They "got it' 

They certainly did.  Throw away IKE and AH, and what's left of IPsec (ESP) is
actually pretty decent - they took the bits that worked and glued them
together to get... well, something else that works.

Unfortunately the result is completely unpalatable to the IPsec folks, and
probably not too palatable for the TLS side either.

Peter.