Subject: [Rserpool] FW: Ports for Rserpool nameserver

From: [email-masked]
Date: Wed, 9 Apr 2003 13:10:55 -0500

Here is the response from Eric Rescorla on our security question.

-- maureen

-----Original Message-----
From: ext Eric Rescorla [mailto:[email-masked]]
Sent: Tuesday, April 08, 2003 11:21 PM
To: Stillman Maureen (NVO-NIC/Ithaca)
Cc: [email-masked]
Subject: Re: Ports for Rserpool nameserver 

Maureen,

I don't know what the IESG's policy about separate ports versus
application-layer signalling is these days. Keith Moore was
the major player there and of course he's no longer AD.

There are two ways to do an upward negotiation solution.
One is unilateral. I.e. the client sends "STARTLS" first
thing and then just starts negotiating TLS. This is obviously
as secure as separate ports, since the client isn't switch-hitting.

The other is real negotiation, in which the client requests
TLS but is willing to switch-hit to normal application-layer
traffic. In this case there's a downgrade attack.

-Ekr

> We are strongly in favor of using TLS for security in Reserpool to
> protect the integrity of the namespace.  TLS would be mandatory to
> implement but optional to use.  Given this, the ENRP name server would
> listen on 2 ports for registration.  One port for insecure
> registrations from pool elements offering a services and the second
> port for secure registrations using TLS.
> 
> However, I had heard that the use of two different ports for a
> service, one for security and one not is deprecated.  Is this correct?
> If so, is there a secure way to upgrade a connection that is not
> secure to TLS?  Isn't this tricky to implement correctly with
> STARTTLS?  We will be using both SCTP and TCP for this as transport.
> We prefer the 2 port solution if the IESG would pass it.  If they
> won't then we need to find some good alternative.
> 
> Thanks for any clarification you can give us.
> 
> -- maureen

_______________________________________________
rserpool mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/rserpool

---

From: [email-masked]
Date: Wed, 9 Apr 2003 13:10:55 -0500

-- maureen

-----Original Message-----
From: ext Eric Rescorla [mailto:[email-masked]]
Sent: Tuesday, April 08, 2003 11:21 PM
To: Stillman Maureen (NVO-NIC/Ithaca)
Cc: [email-masked]
Subject: Re: Ports for Rserpool nameserver 

Maureen,

-Ekr