questions about IDXP (fwd)

James Riordan <[email protected]> Mon, 6 May 2002 18:07:14 +0200
Newsgroups gmane.ietf.idwg
Message-ID <[email protected]> 
I am forwarding this mail to the idwg-public list for
"[ks_c_5601-1987] À¯Àϼ±"<[email protected]> 
who writes:

           O /
----------- X  Cut Here -----------------------------------------------
           O \


I have made researches into the procedure of data sharing among IDS.
Recently I am analyzing IDXP and IAP.
I have questions about IDXP.
 
1. Why must IDXP offer SASL for TUNNEL profile? Is the mutual
authentication offered by only TLS not sufficient? 
 
===================================================================================
     Alice              proxy1               proxy2               Bob
     -- xport connect -->
    <---- greeting ----->
     -- start TUNNEL --->
                         - xport connect[1] ->
                        <----- greeting ----->
                         --- start TUNNEL --->
                                              --- xport connect -->
                                             <----- greeting ----->
                                              --- start TUNNEL --->
                                             <----- <ok>[2] ------
                        <------- <ok> -------
    <------ <ok> -------
    <------------------------- greeting -------------------------->
    <------------ start security profile : SASL------------------->
    <------------------------- greeting -------------------------->
    <------------ start security profile : TLS ------------------->
===================================================================================
 

In the above example, Alice must authenticate twice for SASL profile
and TLS profile.  I think that TLS is sufficient.

2. Is there another security protocol that does not use public key and
fufill the requirement of IDP?  TLS protocol is based on PKI.  Public
Key Infrastructure (PKI ) has reputedly become the answer to all
security problems.  But designing and building full-featured PKI is a
difficult challenge, and as of today, implementations are not
commonplace due to significant interoperability and management
challenges.  PKI and its associated training are also expensive and
complex.  Finally, a hardware device is still required because the
security can be easily breached if the private key is compromised.  I
think that alternative to TLS must exist.

best regards.