[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: "user" and "network layer" security mechanisms.

-----BEGIN PRIVACY-ENHANCED MESSAGE-----
Proc-Type: 4,MIC-CLEAR
Content-Domain: RFC822
Originator-Certificate:
 MIIBvzCCAWkCEFmOln6ip0w49CuyWr9vDVUwDQYJKoZIhvcNAQECBQAwWTELMAkG
 A1UEBhMCVVMxGDAWBgNVBAoTD1NlY3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2Vj
 dXJlV2FyZSBQQ0ExFzAVBgNVBAsTDkVuZ2luZWVyaW5nIENBMB4XDTk1MDUwODIw
 MjMzNVoXDTk3MDUwNzIwMjMzNVowcDELMAkGA1UEBhMCVVMxGDAWBgNVBAoTD1Nl
 Y3VyZVdhcmUgSW5jLjEXMBUGA1UECxMOU2VjdXJlV2FyZSBQQ0ExFzAVBgNVBAsT
 DkVuZ2luZWVyaW5nIENBMRUwEwYDVQQDEwxDaGFybGVzIFdhdHQwWTAKBgRVCAEB
 AgICBANLADBIAkEM2ZSp7b6eqDqK5RbPFpd6DGSLjbpHOZU07pUcdgJXiduj9Ytf
 1rsmf/adaplQr+X5FeoIdT/bVSv2MUi3gY0eFwIDAQABMA0GCSqGSIb3DQEBAgUA
 A0EApEjzeBjiSnGImJXgeY1K8HWSufpJ2DpLBF7DYqqIVAX9H7gmfOJhfeGEYVjK
 aTxjgASxqHhzkx7PkOnL4JrN+Q==
MIC-Info: RSA-MD5,RSA,
 DKm25f1Al+YilzR4LegqMJhKKvS2GDQEJho8nsyZe59nLzoXodExIBdSFE6cKv9/
 pf6m22/3zeAMzU063W96d8Q=

> Michael Richardson wrote:
>   NFS is inherently node-to-node as currently *implemented*, not 
> user-to-server. You can not do user level security associations with currently 
> implemented NFS. I suggest you look at AFS. I do not know enough about 
> Sprite's file sharing to comment where it would stand.
>   I wish NFS would go away, but I do not have a better solution yet. Further,
> NFS doesn't have be implemented the way it is: we *could* push a user-server
> SA down the through the vnode interface. The write-behind/read-ahead is
> implemented by "processes" because of the way Unix works. It is implemented
> as kernel threads on many systems.

I play in the NFS source code all the time.  You have simply restated my
first point -- user level authentication within a network layer security
protocol doesn't work with all applications.

Point number two:  you cannot realistically design a security protocol and 
expect installed sites to rewrite their applications or move to applications 
that Michael Richardson considers to be a better solution.  The market 
dynamics are such that if your security solution does not provide adequate 
security for a customer's network and INSTALLED applications, they will keep
their installed applications and get rid of your security solution.

I am merely stating observations made over the past seven years of 
implementing similar network security protocols.  If you expect a network
layer security protocol to supply user-level authentication, most large
sites will not accept the limitations required by the solution.  We have 
sold such a product in the past.  Market requirements forced us to a
two-layer approach. I don't see the mix of applications being substantially 
different today.  Feel free to disagree and implement user-level security
associations within IPSEC.  Good luck.  Luckily the spec won't force the
rest of us into doing so.

Charlie Watt
SecureWare.

-----END PRIVACY-ENHANCED MESSAGE-----
References: