Re: Fw: Re: Antisniffer measures (digest of posts)

From: Crist J. Clark (cjclark@reflexnet.net)
Date: 01/07/01


Date: Sun, 7 Jan 2001 12:49:41 -0800
From: "Crist J. Clark" <cjclark@reflexnet.net>
To: Garrett Wollman <wollman@khavrinen.lcs.mit.edu>

On Sun, Jan 07, 2001 at 02:25:35PM -0500, Garrett Wollman wrote:
> <<On Sun, 7 Jan 2001 11:21:16 -0500 (EST), Robert Watson <rwatson@FreeBSD.ORG> said:
>
> > an SSL telnet does offer something that SSH does not have: the ability to
> > connect to a new host without a manual keying procedure.
>
> Some people would say that this is a liability. I've got a number of
> particularly argumentative users here who insist that trusted third
> parties of any kind are fundamentally bad. While I don't necessarily
> agree, it is true that in any X.509 configuration it is necessary to
> be very careful about which CAs one trusts and for which purposes.
> (For our SSL applications here, we will only trust our own CA, since
> it is the only one capable of authenticating our users.)

And when we are talking about people connecting among their own
machines, we probably will be talking about self-signed certs
anyway. Who is going to pay Verisign or whoever so that an
administrator can connect from his office to the filesever downstairs?
Starting up your own PKI is non-trivial and expensive, and if you get
it wrong, it is all for nothing since it adds no security.

SSL for login sessions does have a niche, but the PKI for SSL can be
overkill just as the complete lack of a PKI within the SSH protocols
can be problematic. For either one, it all comes back to the problems
of cost-effective and secure PKI and where to balance cost and
security for your needs.

-- 
Crist J. Clark                           cjclark@alum.mit.edu
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-security" in the body of the message


Relevant Pages

  • Re: Proposal for a new PKI model (At least I hope its new)
    ... > Then the world would have no problem trusting your domain level PKI ... coined the term "certificate manufacturing" to distinquish from actual ... it turns out that one of the reasons for the SSL server domain name ...
    (sci.crypt)
  • where did www.debian.org/security/key-rollover/ go?
    ... In response to the latest security issue with ssl / ssh, i updated my packages ...
    (Debian-User)
  • RE: AD & SSL Keys
    ... if you are using SSL than it has to come from the PKI ... infrastructure in your company. ... infrastrure into your current PKI root server and trust it for cert issuing. ...
    (microsoft.public.windows.server.active_directory)
  • CA certificates on W2k
    ... comes to things like SSL and PKI. ... site should use SSL and what would it require from us. ... certificates on my W2k workstation. ... discovered was that my browser never contacted any other servers ...
    (Focus-Microsoft)
  • Re: Question about file permissions
    ... Obfuscation is not a bad thing, ... it's used for passwords, SSL, SSH, etc. ... True security is: ...
    (alt.os.linux.suse)