Subject: Re: [Isms] Coming to consensus

From: "Tom Petch" <[email-masked]>
Date: Fri, 1 Jul 2005 09:54:28 +0200

<inline>
Tom Petch

----- Original Message -----
From: "Fleischman, Eric" <[email-masked]>
To: "Ken Hornstein" <[email-masked]>; <[email-masked]>
Sent: Friday, July 01, 2005 12:42 AM
Subject: RE: [Isms] Coming to consensus

>Group:

>Don't both TLS and SSH require TCP transports while only DTLS can
>support UDP?

To quote from "draft-ietf-secsh-architecture-22.txt"

"The transport layer will typically be
      run over a TCP/IP connection, but might also be used on top of any
      other reliable data stream."

so SSH does not need everything TCP has to offer, just reliability.  (I seem to
recall this coming up in other places, that neither UDP nor TCP are right for
the upper layers, leading protocol designers to cast around for something that
fits better.)

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Fri, 1 Jul 2005 09:38:20 +0200

On Thu, Jun 30, 2005 at 03:42:34PM -0700, Fleischman, Eric wrote:

> My own perspective (for whatever it is worth) is that SNMP has had
> better performance in wireless and bandwidth constrained environments
> using UDP than TCP.

Can you point me to the details of this study?

/js

-- 
Juergen Schoenwaelder		    International University Bremen
<http://www.eecs.iu-bremen.de/>	    P.O. Box 750 561, 28725 Bremen, Germany

---

From: Sam Hartman <[email-masked]>
Date: Sun, 03 Jul 2005 15:41:51 -0400

>>>>> "Fleischman," == Fleischman, Eric <[email-masked]> writes:

    Fleischman,> Group: Don't both TLS and SSH require TCP transports
    Fleischman,> while only DTLS can support UDP? If this is true,
    Fleischman,> isn't our next decision point the evaluation of
    Fleischman,> whether SNMP shall continue to be supported over
    Fleischman,> either TCP or UDP or whether we only want it over
    Fleischman,> UDP? If the former, do we want one "secure session"
    Fleischman,> technology to be used for both UDP and TCP or do we
    Fleischman,> allow the UDP to have a different "secure session"
    Fleischman,> technology than TCP?

    Fleischman,> My own perspective (for whatever it is worth) is that
    Fleischman,> SNMP has had better performance in wireless and
    Fleischman,> bandwidth constrained environments using UDP than
    Fleischman,> TCP. Thus, the view from my knot-hole is that UDP is
    Fleischman,> important. I also would prefer a single generic
    Fleischman,> "secure session" approach. Can SSH support UDP? If
    Fleischman,> not, then I suggest that we use (D)TLS (i.e., TLS for
    Fleischman,> TCP and DTLS for UDP).

As part of your review of TCP vs UDP you need to look at dependent
infrastructure and clearly describe your reliability model.  As I've
pointed out when you start talking about PKI certificate
verification,you tend to involve a lot of services that are fairly
complicated on both sides of the SNMP exchange.

Making SNMP work in an unreliable network may not be very useful if
things it depends on for security do not work.

So, you should be skeptical of an analysis of TCP vs UDP that does not
include:

* An explanation of what types of network failures are expected

* An analysis of what services besides SNMP itself will be required to
  make ISMS work

* An analysis of how the types of network failures that make UDP
  desirable effect these additional services.

--Sam