Subject: RE: [Isms] Coming to consensus

From: "Fleischman, Eric" <[email-masked]>
Date: Fri, 1 Jul 2005 09:29:41 -0700

Tom,

The quote you read means that SSH should not operate on top of an
unreliable data stream such as UDP but it can operate on top of a
reliable data stream such as TCP and probably SCTP.

Based on this quote it would seem to me that to select SSH would imply
that SNMP must use TCP transports only. If so, then I personally advise
against the SSH option because our experience is that SNMP behaves
poorly using TCP within bandwidth limited environments. Therefore, I
prefer SNMP to be able to use UDP. Therefore, based on this limited
information, it appears to me that (D)TLS is a preferable alternative
when compared to SSH.

--Eric

-----Original Message-----
From: Tom Petch [mailto:[email-masked]] 
Sent: Friday, July 01, 2005 12:54 AM

>Don't both TLS and SSH require TCP transports while only DTLS can 
>support UDP?

To quote from "draft-ietf-secsh-architecture-22.txt"

"The transport layer will typically be
      run over a TCP/IP connection, but might also be used on top of any
      other reliable data stream."

so SSH does not need everything TCP has to offer, just reliability.  (I
seem to recall this coming up in other places, that neither UDP nor TCP
are right for the upper layers, leading protocol designers to cast
around for something that fits better.)

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Fri, 1 Jul 2005 13:02:36 -0400

Hi,

> our experience is that SNMP behaves
> poorly using TCP within bandwidth limited environments. 

When you say "our experience", can you qualify "our"? Is that Boeing?
IETF?

Can you share the research that quantifies this assertion?
The debate about TCP or UDP for SNMP has raged for years.
I'd be interested in seeing some rigorous research on this.

David Harrington
[email-masked]

---

From: "Tom Petch" <[email-masked]>
Date: Fri, 1 Jul 2005 19:22:19 +0200

I think the use of the term (D)TLS somewhat misleading.

TLS, reliable transport based, a comprehensive set of I-Ds updating well
established RFC, in turn building on extensive experience of the similar but
differently named SSL, I regard as a mature standard, worthy of serious
consideration for any security issue.

DTLS is a single I-D, in the RFC editor queue (thanks for that), expects to
achieve reliable transport with 64 bits of extra header.  Its pedigree is
impeccable but it is untested. Will it fly? will it prove vulnerable to some
class of attacks, will it be widely available, will it go on being updated in
parallel with TLS?

So I see two very different protocols even if in their elements of security they
share a common set of methods.  To refer to them together as (D)TLS as if were
something like FTP which can be configured to run over TCP or UDP I think
misleading.

Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: "Tom Petch" <[email-masked]>; <[email-masked]>
Sent: Friday, July 01, 2005 6:29 PM
Subject: RE: [Isms] Coming to consensus

Tom,

--Eric

---

From: Kaushik Narayan <[email-masked]>
Date: Fri, 01 Jul 2005 12:04:41 -0700

Hi Eric,

>prefer SNMP to be able to use UDP.

I am not sure that SNMPoDTLSoUDP will behave any better that SNMPoTCP
within those limited bandwidth environments.

regards,
   kaushik!

>Therefore, based on this limited