Subject: Re: NT RAS CCP oddity

From: Glen Zorn <[email-masked]>
Date: Wed, 19 Jan 2000 12:14:40 -0800

>> From: Glen Zorn <[email-masked]>

>> ...
>> > > Now my interpretation is that it should be possible to transfer
IP data as
> >> > soon as IPCP negotiation has completed, regardless of the state
of CCP
> > >> negotiation.
>>
> >It depends.  If encryption (MPPE) is configured on the NT side, then
it makes no
> >sense to transmit data until the CCP negotiation is complete, in fact
it would be
> >a serious security hole.  This is because MPPE is negotiated as part
of CCP.

>Ah, yes, I'd forgotten that design flaw in Microsoft's proprietary,
>non-standard, embrace-and-extend MPPE.

Be that as it may, the IPSec folks seem to think that negotiating crypto
and compression at the same time is not a bad idea...

>Note that the characterization "serious security hole" is based on the
>unsupported and not generally accepted assumption that running with
MPPE
>is noticably more secure than running without MPPE.

Sure, encryption, cleartext, it's all the same, right?

Vernon Schryver    [email-masked]

---

From: James Carlson <[email-masked]>
Date: 19 Jan 2000 16:32:47 -0500

> and compression at the same time is not a bad idea...

What they think about the combination of encryption and compression is
quite irrelevant.  In PPP, encryption and compression use separate
protocols *unless* you're talking to machines made by one particular
vendor.

> Sure, encryption, cleartext, it's all the same, right?

A reasonable administrator who also thinks that encrypting just on a
local link rather than end-to-end (as with IPSec) is somehow useful
would likely *CONFIGURE* the use of both CCP and ECP.  They needn't be
architecturally forced together in order to operate together.

-- 
James Carlson, System Architect                     <[email-masked]>
IronBridge Networks / 55 Hayden Avenue   71.246W   Vox:  +1 781 372 8132
Lexington MA  02421-7996 / USA           42.423N   Fax:  +1 781 372 8090
"PPP Design and Debugging" --- http://people.ne.mediaone.net/carlson/ppp