Subject: [Isms] Coming to consensus

From: Ken Hornstein <[email-masked]>
Date: Thu, 30 Jun 2005 18:31:25 -0400

ISMS participants:

First off, my apologies for not being more active in recent weeks; the
rest of my life keeps intruding onto IETF work.

To cut to the chase: I recently had a conference call with our sheperding
AD, Sam Hartman, regarding the current status of ISMS.  These are the
conclusions that we came to:

- The consensus declaration for encapsulation keying has been accepted by
  the working group.

- There has been no clear consensus expressed by the WG participants regarding
  a particular protocol to be used by ISMS with EK.

- There are three obvious choices (to us) for protocols to be used by ISMS:

	TLS+SASL (more on us throwing SASL into this mix in a moment)
	SSH
	DTLS

Of these three obvious choices, the first two really want a stream transport
(TCP).  Obviously, DTLS does not.

So, the question before the ISMS WG is: which protocol do we want?  Other
suggestions for protocols to be used are welcome; Sam and I just listed
the ones that we saw people talking about, and ones that we thought were
a reasonable fit for ISMS.  We would like the WG to come to a consensus
by August.  If we had a draft by then, that would be great, but we do
not view that as necessary.

Regarding TLS+SASL ... since the desire of ISMS is to produce a protocol
which can leverage other authentication mechanisms, not only do you want
to use TLS (which will provide session encryption plus the use of PK
certificates), but you also want provisions to use SASL (or something like
SASL I suppose, but I'm not aware of an equivalant), which supports
a wide variety of authentication mechanisms.  This combination has been
used by a number of protocols within the IETF community, and seems to
be rather successful.

--Ken

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Kaushik Narayan <[email-masked]>
Date: Thu, 30 Jun 2005 17:06:04 -0700

Hi Ken,

We believe that BEEP should be considered as a choice
of encapsulation protocol for ISMS. This will align us closer
to NetConf and Secure Syslog.

regards,
   kaushik!