Follow Slashdot stories on Twitter

 


Forgot your password?
Close
typodupeerror
×
Security Encryption

Security Top Concern for New IETF Chair 54

Posted by CowboyNeal from the into-the-hot-seat dept.
BobB writes "New IETF chair Russ Housley speaks out about bolting security on after the fact, the prospects for IPv6 and a new security technology called Hokey that could help safeguard wireless and wired networks."
This discussion has been archived. No new comments can be posted.

Security Top Concern for New IETF Chair More

Security Top Concern for New IETF Chair

Comments Filter:

  • chair? (Score:1, Funny)

    by HalifaxRage ( 640242 )
    I would think legs, cushion, and some sort of drink holder would be the primary concerns for any new chair...

    • Re: (Score:2, Funny)

      by Anonymous Coward
      How about throwability? You never now when you have to fucking kill somebody.

    • Re: (Score:1)

      by sokkalf ( 542999 )
      Not to mention Steve Ballmer..
    • This is getting OT, but Pope Joan, the alleged woman pope, prompted the Vatican to create a chair with an opening. The examining cleric would feel through the opening to make sure the Pope was a man [priestsofdarkness.com]. Talk about a security hole!
    • Nope, I'm sure he's mostly concerned with...JOB security!

  • a new security technology called Hokey


    poop-flinging monkeys haven't been enough!

  • Huh? (Score:4, Insightful)

    by khasim ( 1285 ) <brandioch.conner@gmail.com> on Saturday July 28, 2007 @11:26AM (#20023347)

    Do IETF participants have the will to go back and fix insecure parts of the Internet? For example, everyone knows about the lack of security in HTTP, but there seems little will within the IETF to fix the HTTP authentication problem.

    That's because in the case of HTTP, and I suspect in many others, there's little agreement about what's the most important security feature to add. When you say that we'll just fix the most egregious things, then you get into an argument about where to draw the line. In the case of HTTP, the biggest concern is authentication and that is primarily solved by [Transport Layer Security]. Why not mandate TLS? That's a very good question.

    Why "mandate" anything? People who want to run a site with encrypted communications CAN run a site with encrypted communications. Come on people! HTTPS.

    Pretty much a fluff piece. It seems that the interviewer only had some buzzwords and a vague feeling that something was somehow insecure.

    • Re:Huh? (Score:5, Insightful)

      by caluml ( 551744 ) <slashdot@spamgoe ... minus herbivore> on Saturday July 28, 2007 @11:28AM (#20023367) Homepage
      I think a large part of why more people don't use HTTPS is because a:, the certificate problem, and b:, the fact you can't use named based virtual hosts if you do.

      • Re: (Score:3, Informative)

        by TheRaven64 ( 641858 )

        the fact you can't use named based virtual hosts if you do.
        By the way, there is an RFC describing a STARTTLS-like extension for HTTP. You first connect, then you specify the hostname of the server you want, and complete the TLS handshake. This is the same system used for XMPP, SMTP, and IMAP for virtual hosts.

        • Re: (Score:1)

          by _Knots ( 165356 )
          There are in fact several mechanisms, which is part of the problem. There's a TLS extension, Server Name Identification (http://www.ietf.org/rfc/rfc4366.txt), and an HTTP Upgrade: header approach (http://www.ietf.org/rfc/rfc2817.txt). I think consensus is moving towards SNI, and a reasonable chunk of the browsers seem to support it (though OpenSSL does not yet until 0.9.9 comes around). The Apache project is also dragging its feet, waiting for a clear consensus towards one or the other, AFAICT.

          • Re: (Score:2)

            by slamb ( 119285 ) *

            here's a TLS extension, Server Name Identification (http://www.ietf.org/rfc/rfc4366.txt), and an HTTP Upgrade: header approach (http://www.ietf.org/rfc/rfc2817.txt).

            I'd say there's a clear winner there. I don't think anyone thought RFC 2817 through. It suggests (though does not require) sending the initial request in plaintext (ugh), and there's no good mechanism to advertise the server support without penalty on first hit to a https URL (i.e., advertise in the URL or DNS records). Since no existing serve

      • Re: (Score:2)

        by Skapare ( 16644 )

        What certificate problem? They they cost money?

        You have to be able to prove you are not the man in the middle. Otherwise encryption doesn't mean much.

        • I think you could do without the cost and use other means to link a certificate to an entity.

          Theres a project right now for openly available certificates, they are free but you have to prove you own the domain you want a cert for, and of course the CA root has to be in browsers and it isnt right now (though will be soon).

      • I think a large part of why more people don't use HTTPS is because a:, the certificate problem, and b:, the fact you can't use named based virtual hosts if you do.
        It's totally crazy that encryption isn't a default part of all network communications. Screw creating new encrypted protocols for HTTP, FTP, MSN, Skype, IRC, RSH, RCP, POP, SMTP, etc, etc, etc, all with their own faults and issues. This should definitely be tackled at whatever layer is most pervasive, and that's IP.
    • Actually he *is* talking about HTTPS, TLS is the successor to SSL it came about because the MD5 & SHA-1 algorithms have been "technically" compromised.
      • Adding encryption to the communication channel is an additional level to troubleshoot.

        Is your certificate current?
        Do you have enough entropy?
        etc

        We already have it available. Without the mandate. Go to your bank's website and look for the HTTPS. Most other sites (like /.) run regular HTTP because the additional layer and expense of encryption would not gain them anything.

      • Re:Huh? (Score:4, Informative)

        by Zeinfeld ( 263942 ) on Saturday July 28, 2007 @08:58PM (#20027809) Homepage
        Actually he *is* talking about HTTPS, TLS is the successor to SSL it came about because the MD5 & SHA-1 algorithms have been "technically" compromised.

        TLS is the successor to SSL but that is not the reason that the spec came about. The MD5 compromise came after the work was already started.

        The work started when Microsoft sumbitted their Transport Layer Security protocol to the IETF as a standards proposal. Up to that point Netscape had attempted to keep SSL as a proprietary specification under their control. Which was not too popular with those of us who had broken SSL 1.0 without any difficulty and then been completely ignored in the design of SSL 2.0, which was also botched.

        Sometime after the group began to start up Netscape came out with SSL 3.0 which had been extensively reworked by Paul Kocher and Netscape offered to release change control to the IETF. Microsoft agreed since that is all they had actually wanted all along. The only thing that was really changed in the end was the name and the ciphersuite options.

        BTW its not surprising that Russ thinks security is the major challenge, he was until recently the security area director. Before that he was chair of the S/MIME working group.

  • Do the hokey pokey and you turn yourself around. And thats what it all about.

  • In related news (Score:1, Funny)

    by Anonymous Coward
    I bet Microsoft employees can't wait to implement this secure chair protocol as soon as the RFC is released. Anything that helps protect them from Steve Ballmer is more than welcome.

  • Security Top Concern for IETF chair? (Score:3, Funny)

    by Graywolf ( 61854 ) on Saturday July 28, 2007 @11:47AM (#20023481)
    Where can I get one of these secure chairs?

    • Re: (Score:1, Funny)

      by Anonymous Coward
      Where can I get one of these secure chairs?


      Steve B. had one, but I heard he threw it away.

  • Q. Can you give me three specific goals? A. Rollout of IPv6 is clearly one of them. IPv6 is on by default in most OSes and the autoconfiguration [wikipedia.org] feature assures that once the routers enable IPv6, their new IPv6 addresses will be Internet-routable without stateful firewalling, which would break things like VOIP. [wikipedia.org]
    • Too bad the IETF turned around and said that all home routers (like Apple's AirPort) should include deny-by-default stateful IPv6 firewalling. They spent so much effort making IPv6 "just work", and now they're undoing it.

      • Are you saying that you want every device on the entire internet to be able to speak to your system directly, without hindrance, by default?

        You want everyone else's systems to be able to be contacted, directly, without hindrance, by default?

        You do realize that the internet used to be like that, right? Do you remember what happened as a result? Do you know why firewalls were invented in the first place?

        • Ah, I do so appreciate the patronizing. In a home environment I think host-based firewalls are easier to configure and diagnose than network-based ones, and thus I would prefer that network equipment not deny any traffic by default.

  • The best of Verisign AND the NSA!! (Score:1, Insightful)

    by Anonymous Coward
    Housley: "VeriSign is giving me a check a month, and the National Security Agency is paying my travel costs. "

    What could go wrong here?
    • I'm not say _this_ guy in particular is the trojan horse for the end of an anonymous Internet, but it's one step closer.

      At this point in the game, it's assumed all traffic is being monitored through the Telco's. http://www.salon.com/news/feature/2006/06/21/att_n sa/index_np.html [salon.com]

      Having an NSA friendly agent running the IETF will make their jobs much easier. I boldly predict next to nothing will be done publicly by this guy. I have a feeling he will be **very** busy not as chair, but as an NSA rep who just
  • It would be nice if more articles mentioned the full name of whatever acronym makes the tagline. You know... so I don't have to think about it too hard... or even look it up.
    • HOKEY = Hand Over Keying

      Rekeying security protocols when handover mobile devices from one AP or BS to another takes time and disrupts communications. So fix it. That's what HOKEY does.

  • Watched the presentation at Chicago earlier this week. HTTPBis BOF basically dealt with these:

    http://www3.ietf.org/proceedings/07jul/slides/http bis-2.ppt [ietf.org] - Chair's Slides
    http://www3.ietf.org/proceedings/07jul/slides/http bis-1.pdf [ietf.org] - Cookies & Caching
    http://www3.ietf.org/proceedings/07jul/slides/http bis-0.pdf [ietf.org] - Etags

    The "Chair's slides" basically deal with HTTP Auth issues. Take a look - the presentations were rather interesting, altough it seemed at the time that a WG may not be formed out of these.

    • Re: (Score:2)

      by Zarhan ( 415465 )
      Hmmh, apparently the presentation about auth cited in the Agenda slide is not online yet. Sorry - apparently exactly the on-topic presentation is still pending publication :)
  • IPv6 is soooo 1996
  • Security Top Concern for New IETF Chair

    It suddenly collapses when sat on?

  • Please stop with the cutesy names! (Score:3, Interesting)

    by pongo000 ( 97357 ) on Saturday July 28, 2007 @06:37PM (#20026889)
    Gimp...Pidgin...and now...

    Hokey?

    Hokey?

    I don't know about the rest of the world, but here in the US "hokey" is used to refer to something artificial, contrived, fake. I certainly don't want to trust the security of my systems to something that's contrived.

    Geez, more proof that intelligence and common sense aren't necessarily bed partners...

  • IPv6 and IPsec (Score:3, Informative)

    by Skapare ( 16644 ) on Saturday July 28, 2007 @09:03PM (#20027835) Homepage

    IPsec works over IPv4. IPv4 works without IPsec. I haven't found anyone (yet) that has gotten IPsec over IPv6 (I'm not talking about IPv6 tunneled over IPsec protected IPv4) to actually work on Linux or BSD. Surely someone has. But Google turns up a number of reports of problems that go unresolved and unanswered (except in one case people reporting they also cannot get it to work). I've only been spending a couple weeks trying to get it to at least establish a security association between 2 machines.

    Which protocol to scrap and start over? Or is it just bad implementation? If we can at least get this working, IPv6 might be considered ready to go.

  • You're already seeing it with anti-Spam blacklists. People are blocking who they think don't behave well. Soon it will change to only allowing those they feel are. Like it or not, security in protocol enhancement is coming. If the OSS community resists it, then the only alternative will be the TCG/TPM, and we will have a network that forks, despite shared network layer protocols.
    Just as the Linux community seems to have learned nothing from the way the tower of babel effect hamstrung unix, so it seems that
  • Russ is a security guy. I'd be rather surprised if his top priority was something other than... security.

Slashdot Top Deals

Get hold of portable property. -- Charles Dickens, "Great Expectations"

Close