Subject: AW: [Isms] TLS Inner Application Extension

From: Tschofenig Hannes <[email-masked]>
Date: Mon, 18 Apr 2005 09:41:09 +0200

# hi sam, 

# thanks for your reply. 

> >>>>> "Tschofenig" == Tschofenig Hannes 
> <[email-masked]> writes:
> 
>     Tschofenig> hi all, may i draw your attention to the following
>     Tschofenig> document that might be relevant for your work:
>     Tschofenig> 
> http://www.ietf.org/internet-drafts/draft-funk-tls-inner-appli
cation-extensi
    Tschofenig> on-01.txt

    Tschofenig> as a short summary: it integrates the extensible
    Tschofenig> authentication protocol (eap) into the tls handshake.

    Tschofenig> i personally think that this provides much better
    Tschofenig> properties than the proposal of carrying sasl over tls
    Tschofenig> (as proposed in <draft-schoenw-snmp-tlsm-01.txt>).

Note that I'm likely to have the same EAP applicability concerns about
this document as I did about the original EUSM proposal.
# although they show some differences...

  Clearly if
scoped within eap-tls or something like that this would be a
reasonable proposal, but I do not thing it is reasonable as a solution
for all cases where TLS is applicable.

# i think it is pretty similar to the usage of ikev2. you could use ikev2
(with eap) to establish ipsec sas to secure snmp. this is just at a
different layer. for me it is difficult to understand why people have no
problem with ikev2/ipsec usage (although it is not only used for network
access/vpn) but raise concerns about other protocols that essentially do the
same. 

# btw, what is your impression about using sasl (or the gss-api) on top of
tls? (for example, binding the keys of the two sessions together). if you
actually interact with the aaa infrastructure then you end up having an
eap-aaa alike architecture. 

# ciao
# hannes

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms