[Prev][Next][Index][Thread]
Re: NULL_ ciphersuite meets ftps
> I believe that the proposal to remove NWNN and the proposal
> to define 990 as ftps are mutually exclusive.
I'd think not. TLS_NULL_WITH_NULL_NULL is an unprotected connection.
Rather than using TLS with that cipher suite, just don't use TLS.
No loss of functionality whatsoever.
> The much preferred route is to allow the control connection to
> negotiate the protection level of the data connection. (see the PROT
> command in the CAT draft-ietf-cat-ftpsec-09.txt)
This proposal is _far_ more complicated than the FTP approach described
in draft-murray-auth-ftp-ssl-00.txt ... and it doesn't even talk about
how to make this work with TLS.
Other than the PROT command (which could be added to the ftp-ssl draft),
the primary technical advantage that I notice in cat-ftpsec is that it
explicitly addresses Kerberos. Wouldn't it be a lot better to follow
draft-ietf-tls-kerb-cipher-suites-00.txt to Kerberize SSL, and then
follow the ftp-ssl draft's simpler approach for the rest?
> I don't see how this can be accused of holding anything up, as the
> draft (cat-ftpsec) is already written and awaiting eager developers.
Similarly, draft-murray-auth-ftp-ssl-00.txt is already written etc.
Speaking as a potential implementor, the approach in the ftp-ssl draft
gets my vote on time to market and on how readily it can be implemented
correctly and interoperably.
- Dave
Follow-Ups: