Subject: [Isms] Latest draft of TLS w/ SRP

From: "McDonald, Ira" <[email-masked]>
Date: Sun, 30 Oct 2005 08:10:33 -0800

Hi,

Although this ISMS WG has now turned away from TLS to SSH
(unwisely IMHO), to set the record straight, the work on TLS
w/ SRP is very much alive and well.  The latest draft is:

  Using SRP for TLS Authentication, October 6 2005
  ftp://ftp.ietf.org/internet-drafts/draft-ietf-tls-srp-10.txt

Given that the IESG is very unlikely to approve SNMP over SSH
without a mandatory IANA-registered port, arguments against
using TLS for ISMS seem dubious to me.

Whatever security protocol is used below the SNMP application 
layer, the SAs (security associations) at the lower layer (SSH, 
TLS, whatever) and the SNMP layer will have to be securely 
cryptographically bound or else the SSH SA MUST require strong 
mutual authentication or else active man-in-the-middle attacks 
will be trivially easy.

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Blue Roof Music / High North Inc
PO Box 221  Grand Marais, MI  49839
phone: +1-906-494-2434
email: [email-masked]

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms

---

From: "David B Harrington" <[email-masked]>
Date: Sun, 30 Oct 2005 18:42:14 -0500

Hi Ira,

Did I miss something? What arguments against using TLS?

I thought we simply decided that SSH seemed to be more in demand by
operators for network management purposes.

dbh 

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of McDonald, Ira
> Sent: Sunday, October 30, 2005 11:11 AM
> To: [email-masked]
> Subject: [Isms] Latest draft of TLS w/ SRP
> 
> Hi,
>