Subject: [Isms] TLS and DTLS should not be considered together

From: Sam Hartman <[email-masked]>
Date: Wed, 13 Jul 2005 17:28:17 -0400

Hi.  Just a reminder that the natural way to do authentication with
TLS (TLS+SASL) is not such a good option with DTLS.  You can design an
approach where DTLS and TLS are used (DTLS for UDP, TLS for TCP).  You
have two approaches for what to do with TLS.  You can use the same set
of authentication available with DTLS.  Or you can use SASL+TLS like
the application protocols.  You need to carefully consider these
tradeoffs and understand exactly what you are getting with a DTLS+TLS
approach.

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 14 Jul 2005 00:56:07 -0700

Sam Hartman <[email-masked]> writes:
> TLS (TLS+SASL) is not such a good option with DTLS.
It's absolutely true that SASL over DTLS is not straightforward.

However, it seems to me that this is a generic observation about
any datagram approach, no? I.e., the problem is that SASL
wasn't designed to work over unreliable channels. So, if 
you're going to do inband keying and you want an unreliable
channel, you've got to face this... (I'm not qualified
to have an opinion about whether you *should* want to use
UDP, just saying that if you do want to...)

-Ekr

---

From: Sam Hartman <[email-masked]>
Date: Thu, 14 Jul 2005 12:06:01 -0400

>>>>> "Eric" == Eric Rescorla <[email-masked]> writes:

    Eric> Sam Hartman <[email-masked]> writes:
    >> Hi.  Just a reminder that the natural way to do authentication
    >> with TLS (TLS+SASL) is not such a good option with DTLS.
    Eric> It's absolutely true that SASL over DTLS is not
    Eric> straightforward.

Yes, but I don't know of any other datagram approaches being
considered.