Re: Moving forward (fwd)

[Ned Smith <nsmith@xxxxxxxxxxxxxxxxxx>]

An anonymous respondent writes:
>> Maybe it makes sense to say certain key exchange methods
>> MUST be implemented but leave the policy of cipher, keysize,
>> mode, hash alg as SHOULDs. This way the TLS spec
>> wouldn't be in the position of mandating elements of site
>> security policy, while it would mandate key exchange
>> "mechanisms". (Essentially, TLS is a key exchange protocol
>> afterall).
>>
>
>By mandating key exchange methods aren't you
>mandating elements of the security policy?

Yes. It is somewhat of a compromise proposal. The key exchange protocol can
be viewed more as a mechanism than can the other elements of the
ciphersuite. The other parts are more easily parameterized.  If a site
security policy made
explicit statements about how key exchange is to be done, then the site
security officer would select from contenders of key exchange protocols
(say ISAKMP/Oakley or TLS or custom solution). Within that context the more
dynamic parameters of how the data is to be protected (cipher, key size
etc) should be left to the application to specify. Hence, would be SHOULDs
in the TLS spec.

Making only the key exchange protocol a MUST would limit the range of
semantic interpretation of any given ciphersuite. Consider the possibility
of defining a ciphersuite whose semantic interpretation translated to
ISAKMP key exchange. I may be putting words int he mouths of IESG, but
maybe this kind of flexibility in the interpretation of ciphersuites is not
viewed as benneficial. Indeed, I have in the past (not on this list) chided
SSL ciphersuites for being too openended - allowing virtually any semantic
interpretation (constrained only by the 3 PDU flows). TLS ciphersuite
mechanism is basically unchanged from SSLv3.

Ned Smith                 Intel Architecture Labs 
JF2-74  2111 N.E. 25th Ave.  Hillsboro, OR. 97124
Ph: 503.264.2692 Fax: x1805  Mailto:nsmith@xxxxxxxxxxxxxxx
Http://www.intel.com/ial/security/index.htm
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~