Subject: RE: [Syslog] Re: Threat model and charter

From: "Anton Okmianski \(aokmians\)" <[email-masked]>
Date: Tue, 17 Jan 2006 16:54:59 -0500

Sam:

> May I recommend TLS PSK 

Interesting option. Probably not as mature as just using HMAC message digests. 

Is there some document which compares and contrasts TLS and SSH?  It seems recent RFCs surrounding both have put them on a redundancy path.  I'd really like to learn why IETF is pursuing both of those at the same time. 

> or TLS in anonymous DH mode in 
> preference to inventing your own transport that does not use PKI?

This, I think, does not accomplish an objective of authentication or frankly any non-trivial security, unless I am missing something. It does not really do privacy either since it is susceptible to man-in-the-middle. 

> Also, before doing something based on shared secrets 
> carefully consider the requirements of RFC 4107.

Good read. Thanks! 

It bring up a question as to what kind of environment syslog really addresses: private-only network or private and public. It is one thing to manage alerts from web server farm and another thing to manage millions of consumer CPEs such as internet modems, VoIP ATA, etc. A lot of CPE protocols nowadays go towards having a built-in certificate or even multiple of them. In the case of alerts from something like VoIP ATA which would go over public network, I would think privacy would be more important too. 

I have also never been clear on the scope of syslog vs SNMP. There is a large overlap. It would be great if this was clear in the charter.  I hope I am not opening up a deep rat hole here.  

Thanks,
Anton. 

_______________________________________________
Syslog mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/syslog

---

From: "Tom Petch" <[email-masked]>
Date: Wed, 18 Jan 2006 21:08:41 +0100

----- Original Message -----
From: "Anton Okmianski (aokmians)" <[email-masked]>
To: "Sam Hartman" <[email-masked]>
Cc: "Chris Lonvick (clonvick)" <[email-masked]>; "Tom Petch"
<[email-masked]>; <[email-masked]>
Sent: Tuesday, January 17, 2006 10:54 PM
Subject: RE: [Syslog] Re: Threat model and charter

Is there some document which compares and contrasts TLS and SSH?  It seems
recent RFCs surrounding both have put them on a redundancy path.  I'd really
like to learn why IETF is pursuing both of those at the same time.

[tp]
As I said previously, I think that transport level security is a topic for 2007
and not 2006, but if and when we do go down that route, then I think the choice
of which needs careful consideration.

SSL, and to some extent TLS, is stated to be the most widely used security
system on the
Internet but then it is used with that most widely used protocol HTTP,
to access (Enterprise) web servers.

Look at network operators and a different picture emerges.  The survey that was
required before isms came into being showed that ssh was the most widely used
system; TLS did not figure, appearing less often than Windows Active Directory,
while local accounts scored higher than RADIUS/.TACACS+ (this is also the
picture
I get from looking at network products on websites).  This set the direction for
isms.

Whatever the issues are of distributing security credentials, they have been
accommodated, else these systems would not be in use (although I suspect the
quality of key management might not meet the standards wanted by the IETF)..

So for me the choice should is one of the marketplace.  Enterprise web servers
and
SSL(TLS) is in place and should give good leverage.  Network Operators and the
answer is SSH.

Tom Petch