Subject: Re: [Speechsc] Default support for TLS?

From: Dan Burnett <[email-masked]>
Date: Tue, 6 Jun 2006 09:51:37 -0700 (PDT)

Tracked at http://www.softarmor.com/roundup/speechsc/
as issue 83.

--- "Carter, Jerry" <[email-masked]> wrote:

> I've been trying to understand the origin of the
> language in section 12.2:
> 
>  
> 
>     To ensure control channel protection, MRCPv2
> clients
>     and servers MUST support TLS and SHOULD utilize
> it
>     by default.  Alternative control channel
> protection
>     MAY be used if desired (e.g. IPSEC).
> 
>  
> 
> I understand the need for TLS support as a technique
> for addressing security
> concerns in many environments.  TLS is a good thing.
>  But, I do not
> understand why TLS defaults to 'ON'.  
> 
>  
> 
> Looking back at the minutes from summer 2004 (e.g.
>
http://www1.ietf.org/mail-archive/web/speechsc/current/msg00888.html
<http://www1.ietf.org/mail-archive/web/speechsc/current/msg00888.html>
> )
> when TLS was added, I cannot find anyone arguing for
> this default value.
> Looking at the emails between drafts 6 (where TLS
> was not the default) and 7
> (when TLS became the default), I can't find anyone
> arguing for this change.
> When did the SpeechSC group agree to this?
> 
>  
> 
> I am concerned here because the majority of
> telephony deployments, the MRCP
> server and client are running on the same trusted
> network.  In many cases,
> the cpu & latency costs for performing an
> unnecessary encryption step are
> desired.  For these buyers, using TLS by default is
> a barrier for
> deployment.
> 
>  
> 
>  
> 
> > _______________________________________________
> Speechsc mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/speechsc
> 

__________________________________________________
Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 
http://mail.yahoo.com 

_______________________________________________
Speechsc mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/speechsc