Subject: Re: SecurID(r) tokens and multi-step authentication exchanges

From: "Steven M. Bellovin" <[email-masked]>
Date: Tue, 02 Jan 2001 14:11:46 -0500

In message <[email-masked]>, "Yaron Sh
effer" writes:
>Hi Tero,
>
>I'm not sure I want to be drawn into a theological discussion, but anyway.
>
>For a security protocol, you want to use:
>
>1. Standard building blocks.
>2. Building blocks that are (or have been) implemented with security in
>mind.
>
>(1) would point you towards SASL or EAP, rather than HTTP plus CGI
>scripting.

I'd call http far more standard; ditto SSL.
>
>(2) implies you want to reduce your reliance on "general" standards that may
>have hidden security problems, either in protocol or implementation. You can
>reasonably expect that a typical *implementation* of IKE is more secure than
>a typical implementation of HTTP.

Why?

		--Steve Bellovin