Re: [Isms] pre11 comments

["David B. Nelson" <dnelson at elbrysnetworks.com>]

Wes Hardaker writes...

> This all means that *if* we want to allow separate authorization
> levels for different secure transports (and I'll argue that we
> do want to)...

Well, yeah, but where do we stop?  Someone might argue that the transport
protocol alone isn't enough.  Maybe they want to add cipher-suite into the
selection.  Or maybe key length, or maybe the specifics of the certificate
chain.  I could go on and on, specifying all sorts of security properties of
the transport that conceptually *could* make a significant difference in
*some* scenario.

I think that we should keep this very simple.  For that reason, I'm not
convinced that we need to sub-specify the TSM by its underlying protocol.
If a particular protocol is "compromised" the operator always has the option
to simply de-configure it.

Let's solve the "80% problem" and declare victory.

_______________________________________________
Isms mailing list
Isms at ietf.org
https://www.ietf.org/mailman/listinfo/isms