Subject: Re: Last Call: Telnet Authentication Option to ProposedStandard

From: William Allen Simpson <[email-masked]>
Date: Wed, 24 Nov 1999 08:26:00 -0500

The poster forgot to include the only list that counts, the IETF where 
Last Calls are discussed.

This is not mail, where Application level security makes sense.  This is 
Telnet, a service that is explicitly and only an on-line, connected, 
end-to-end protocol.  Another layer of security adds no value.

Especially as this has admitted security problems!  I have no stomach for 
"blessing" bad ideas, just because they've been used for a long time....

If nobody would suggest a similar design today, then publishing them with 
Historic designation might be appropriate.

-------- Original Message --------
Subject: Re: Last Call: Telnet Authentication Option to ProposedStandard
Date: 24 Nov 1999 10:21:09 +0100
From: [email-masked] (Johan Danielsson)
To: William Allen Simpson <[email-masked]>
CC: [email-masked]

William Allen Simpson <[email-masked]> writes:

> We already have authentication and encryption at link layer (PPP),
> network layer (IPSec), transport layer (TLS), and session layer
> (SecSHell).  Why do we need application layer security, too?

This is another debate, but I would argue that it's *only* at the
`application layer' that encryption and authentication makes
sense. How can I trust IPsec when I don't know who's controlling the
keys? Encryption at other levels might have their own applications,
but it doesn't necessarily provide any explicit security to the end
user.

Anyway, the telnet encryption stuff has been in use for many years,
and this is just revival of some old drafts. They do have security
problems, and nobody would suggest a similar design today.

/Johan

---

From: [email-masked] (Johan Danielsson)
Date: 24 Nov 1999 14:40:54 +0100

William Allen Simpson <[email-masked]> writes:

> The poster forgot to include the only list that counts, the IETF
> where Last Calls are discussed.

I explicitly removed it because my last post didn't have much to do
with the standardisation process.

> This is not mail, where Application level security makes sense.
> This is Telnet, a service that is explicitly and only an on-line,
> connected, end-to-end protocol.  Another layer of security adds no
> value.

Another layer to what? What other security is there that I have
control over? Please enlighten me about this mysterious security that
works by magic, and that nobody talks about.

> If nobody would suggest a similar design today, then publishing them
> with Historic designation might be appropriate.

Historic implies that it isn't in general use. Telnet encryption is,
no matter what you think about it.

/Johan

---

From: [email-masked] (Johan Danielsson)
Date: 24 Nov 1999 14:40:54 +0100

/Johan

---

From: William Allen Simpson <[email-masked]>
Date: Wed, 24 Nov 1999 09:58:56 -0500

> works by magic, and that nobody talks about.
Maybe you aren't talking to the right folks....

I use Nifty Telnet with SSH, and OpenSSH is on the other end.  SSL (TLS) 
is incorporated in my Navigator browser, and OpenSSL is on the other end. 
NAI PGPnet is in my menu bar, and OpenBSD or Linux FreeSWAN is on the 
other end.

"Any sufficiently advanced technology is indistinguishable from magic."
(Niven?)

> no matter what you think about it.
4.2.4  Historic

   A specification that has been superseded by a more recent
   specification or is for any other reason considered to be obsolete is
   assigned to the "Historic" level.  (Purists have suggested that the
   word should be "Historical"; however, at this point the use of
   "Historic" is historical.)

[email-masked]
    Key fingerprint =  17 40 5E 67 15 6F 31 26  DD 0D B9 9B 6A 15 2C 32

---

From: William Allen Simpson <[email-masked]>
Date: Wed, 24 Nov 1999 09:58:56 -0500

4.2.4  Historic

[email-masked]