Subject: RE: Why not TLS was Re: [Syslog] Secure substrate - need your input

From: "Moehrke, John \(GE Healthcare\)" <[email-masked]>
Date: Wed, 26 Oct 2005 13:34:15 -0500

TLS Version 1.0
January 1999
RFC-2246 Section 
7.4.6 Client Certificate 

I did assume that when you said "authorisation" that you really meant
"authentication". If this assumption is wrong, then you have yet more
questions to ask. Authorization is not handled by any of the protocols
at this layer.

John

-----Original Message-----
From: Tom Petch [mailto:[email-masked]] 
Sent: Wednesday, October 26, 2005 12:22 PM
To: Moehrke, John (GE Healthcare); [email-masked]
Subject: Re: Why not TLS was Re: [Syslog] Secure substrate - need your
input

<inline>
Tom Petch

----- Original Message -----
From: "Moehrke, John (GE Healthcare)" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, October 26, 2005 6:07 PM
Subject: RE: Why not TLS was Re: [Syslog] Secure substrate - need your
input

There is a miss understanding of the information I have seen given by
many people on this list regarding TLS.  I think this miss understanding
is also being applied to SSH.

<snip>
So, SYSLOG needs to ask do they want to authenticate the user, machine,
or both?

Tom - yes, agree strongly but I don't know the answer.

TLS does support mutual node authentication. The healthcare world has
been using mutual-node-authenticated-TLS for over three years. We use it
often to ensure that a X-Ray device is actually talking to the Picture
Archiving Service. Both systems need to know that they are talking to
the right 'other' system. This transaction doesn't need to have user
authentication as the process is fully automated. Indeed we don't always
turn on TLS encryption. But we do always do mutual-authentication. Yes
this means that there is a X.509 certificate managed for both nodes. But
this certificate management is not nearly as complex as
person-certificates (another discussion we can have on
miss-understandings due to the wrong questions being asked).

Tom- this one puzzles me.  SSH has got server and client authorisation
defined
in the I-Ds, soon to be RFCs.  Reading the TLS I-Ds I see no sign of
client
authorisation and since that is a must for SNMP, then the note I quoted
earlier,
to the isms list, saying that SASL would needed alongside TLS made
perfect sense
(as I would expect since it came from the Security AD:-).  So where does
mutual
authentication come from?  What RFC or I-D defines it?  Is it a
proprietary
extension? Is it two simplex transmissions with only server
authentication?
Sometimes it does matter to know what goes on under the covers.  (Of
course, if
client authentication is not needed then this is academic).

<snip>
John

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Tom Petch" <[email-masked]>
Date: Wed, 26 Oct 2005 20:55:28 +0200

Miss information indeed on my part, thanks for putting me right.

And yet, and yet, there was a reason why TLS alone would not work for SNMP and
so SASL would be needed alongside TLS for that context, as the extract I quoted
from the Security AD said.  I will dig some more to find what it was.

More generally, I would ask the chairs of this WG to see if their Security
advisor has any generic thoughts on what protocols are appropriate.  The isms
group got one or two surprises along the way in this area, perhaps reflecting a
preponderance of operations skills over security skills.

Tom Petch

----- Original Message -----
From: "Moehrke, John (GE Healthcare)" <[email-masked]>
To: "Tom Petch" <[email-masked]>; <[email-masked]>
Sent: Wednesday, October 26, 2005 8:34 PM
Subject: RE: Why not TLS was Re: [Syslog] Secure substrate - need your input

TLS Version 1.0
January 1999
RFC-2246 Section
7.4.6 Client Certificate

John

-----Original Message-----
From: Tom Petch [mailto:[email-masked]]
Sent: Wednesday, October 26, 2005 12:22 PM
To: Moehrke, John (GE Healthcare); [email-masked]
Subject: Re: Why not TLS was Re: [Syslog] Secure substrate - need your
input

<inline>
Tom Petch

----- Original Message -----
From: "Moehrke, John (GE Healthcare)" <[email-masked]>
To: <[email-masked]>
Sent: Wednesday, October 26, 2005 6:07 PM
Subject: RE: Why not TLS was Re: [Syslog] Secure substrate - need your
input

<snip>

<snip>
John