Re: www.isoc.org unreachable when ECN is used

2003-12-12 Thread kent
On Fri, Dec 12, 2003 at 06:23:48AM +0100, Anthony G. Atkielski wrote: But since ISOC's firewalls have not been updated, you won't be able to get to their site from Linux. Nonsense. I'm running Linux, several versions. I can get to the ISOC site from all of them. -- Kent Crispin

Re: Hashing spam

2003-12-18 Thread kent
be lost in the normal noise of ietf processes. Regards Kent On Dec 18, 2003, at 3:01 PM, Vernon Schryver wrote: 1. on-topic messages from subscribers 2. on-topic messages from non-subscribers 3. noise from subscribers 4. noise from non-subscribers 5. pure spam such as advertisements

Re: Hi

2004-01-19 Thread kent
-dresden.de/1.php http://www.micronuke.net/1.php http://www.stadthagen.org/1.php etc -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED]

Re: Withdrawal of Approval and Second Last Call: draft-housley-tls-authz-extns

2007-04-11 Thread kent
On Wed, Apr 11, 2007 at 01:54:53PM +0200, Brian E Carpenter wrote: Ted, Well, if IPR owners don't actually care, why are they asking people to send a postcard? It would seem to be an unnecessary administrative burden for the IPR owners, yes? My assumption is that they care if the party

problem dealing w/ ietf.org mail servers

2008-07-02 Thread 'kent'
be a whole lot of boxes in this situation. Kent PS -- I'm not sure this will actually make it to the ietf list :-) ... ___ Ietf mailing list Ietf@ietf.org https://www.ietf.org/mailman/listinfo/ietf

Re: problem dealing w/ ietf.org mail servers

2008-07-04 Thread kent
; in light of all this I'm going to have to rethink that decision. For a server, the combination of enabling ipv6 and using this particular anti-spam technique may drastically increase the number of false positives -- especially as ipv6 gets more widely deployed. Best Regards Kent

Re: problem dealing w/ ietf.org mail servers

2008-07-04 Thread kent
, and in my experience, most people would rather deal with some spam than lose important email. Kent ___ Ietf mailing list Ietf@ietf.org https://www.ietf.org/mailman/listinfo/ietf

Re: Last Call: Registry Registrar Protocol (RRP) Version 1.1.0 to Informational

1999-12-31 Thread Kent Crispin
/Registrar protocol that may appear later. Agreed! Likewise. -- Kent Crispin "Do good, and you'll be [EMAIL PROTECTED] lonesome." -- Mark Twain

Re: Internet SYN Flooding, spoofing attacks

2000-02-11 Thread Stephen Kent
Paul, I object to the characterization of my comments as "propagating FUD." One might equally well suggest that 2267 constitutes a naive model of how to prevent IP spoofing, but I was polite enough not to say that :-). From a security perspective, it is never desirable to rely on a

Re: Internet SYN Flooding, spoofing attacks

2000-02-16 Thread Stephen Kent
Dan, I'll suggest one course of action, but I keep emphasizing the issue is not one of alternates, but of recognizing the limitations of proposals now on the table and considering approaches that may work irrespective of whether everyone performs filtering. With regard to a wide range of DoS

RE: Internet SYN Flooding, spoofing attacks

2000-02-16 Thread Stephen Kent
Eliot, Some of the DoS attacks we saw last week were good, old-fashioned SYN floods. Hosts do have a responsibility here, more than ISPs, since it is quite feasible to tie up a host's pool of TCBs with a small number of packets, even if the attack tool does not use spoofed sourced addresses

Re: Internet SYN Flooding, spoofing attacks

2000-02-16 Thread Stephen Kent
Steve, The ATT experiences might be different, but at GTE-I, a SYN flood was the primary attack mechanism for one major web site that we host. Also, it is not at all clear that our network had a problem handling the other flooded traffic (ICMP Echo Reply and UDP traffic) that was sent to 3

Re: recommendation against publication of draft-cerpa-necp-02.txt

2000-04-07 Thread Stephen Kent
Keith, Without comments on other aspects of the technology in question, I would like to make some observations about the security aspects of the processing you cite as violating IP. By now we all should know that it is a bad idea to rely on an unauthenticated IP address as a basis for

Re: recommendation against publication of draft-cerpa-necp-02.txt

2000-04-07 Thread Stephen Kent
Leslie, I understand your point, but we leave ourselves open to many forms of attacks, or errors, by assuming that "what you receive is what was sent" in this era of the Internet. Security is not black and white, but the gray area we're discussing does bother me. If one cares about knowing

Re: recommendation against publication of draft-cerpa-necp-02.txt

2000-04-07 Thread Stephen Kent
Keith, Stephen, perhaps the reason that the tools are not used is that they are not adequate for the task. but it certainly does not follow that "if one doesn't use the tools, then one does not care very much". or perhaps, one does not care enough ... Steve

Re: recommendation against publication of draft-cerpa-necp-02.txt

2000-04-07 Thread Stephen Kent
Paul, I have a time machine. I just went back 20 years in time, convinced everybody that it was always more important to implement proper security than to make do with existing features and quick fix solutions. Having thus changed the future, I went back forward in time. Guess what---there

RE: recommendation against publication of draft-cerpa-necp-02.txt

2000-04-07 Thread Stephen Kent
Christian, Suppose, rhetorically, that we were to encrypt every IP packet using IPSEC. What happens if a box takes your packet and deliver it to the "wrong" address, for example to an ISP controlled cache? Well, the cache cannot do anything with it, except drop it to the floor. We are thus

Re: Internet vs internet

2000-07-08 Thread Kent Crispin
In many RFCs, "internet" is used as adnoun. "adnoun"? Is that like an adverb? -- Kent Crispin "Do good, and you'll be [EMAIL PROTECTED] lonesome." -- Mark Twain

Re: [IFWP] Re: Complaint to Dept of Commerce on abuse of users by ICANN

2000-07-31 Thread Kent Crispin
frames -- as far as I know, there are no frames in the entire ICANN site; 2) the secure registration page is OPTIONAL; you can register through a nonsecure path. -- Kent Crispin "Do good, and you'll be [EMAIL PROTECTED] lonesome.&quo

Re: draft-ietf-pkix-time-stamp-09

2000-09-11 Thread Stephen Kent
Adrian, Just to confirm that I too have problems with the standard which I'm prepared to express at some length. Technically, it'll sure it'll fly but I'm really, really worried about the evidential rigour. Ultimately, the TSA will have to testify in a court and it has got to work - for the

Re: An Internet Draft as reference material

2000-09-22 Thread Stephen Kent
I want to second Bob Braden's pithy observation re I-Ds. If they make it through the process and become RFCs (including informational RFCs) then they clearly merit retention and they achieve it, since RFcs are archival. However, many I-Ds do not make it through the process and to archive

Re: An Internet Draft as reference material

2000-09-22 Thread Stephen Kent
Pete, Stephen Kent wrote: I want to second Bob Braden's pithy observation re I-Ds. If they make it through the process and become RFCs (including informational RFCs) then they clearly merit retention and they achieve it, since RFcs are archival And I'll make a pithy counter

Re: An Internet Draft as reference material

2000-09-22 Thread Stephen Kent
Tim, The April fool's day RFCs aside, I agree that not all I-Ds that fail to make the cut as an RFC are inferior. However, there are many other venues for publishing technical material, many of which subject the material to review. An I-D that contains good material but fails to become an

Re: Topic drift Re: An Internet Draft as reference material

2000-09-26 Thread Stephen Kent
As someone who was around when the notion of an I-D was created, let me disagree somewhat. There was a very definite intent to cause I-Ds to "officially" disappear after a limited time frame. Steve

Re: Topic drift Re: An Internet Draft as reference material

2000-09-28 Thread Kent Crispin
rior art raises an interesting possibility: forged or altered IDs being used to challenge patents. That's another reason to have a definitive archive available. -- Kent Crispin "Do good, and you'll be [EMAIL PROTECTED] lonesome." -- Mark Twain

Re: Topic drift Re: An Internet Draft as reference material

2000-10-01 Thread Kent Crispin
no such claim would be possible. I'm sure it would be an interesting legal case... -- Kent Crispin "Do good, and you'll be [EMAIL PROTECTED] lonesome." -- Mark Twain

Re: bandwidth (and other support) required for multicast

2001-04-01 Thread Kent Crispin
fle innovation, then they lose legitimacy. I don't want to put words in Keith's mouth, but I think he would say that the core of his concern is that patents are now being used to stifle creativity. -- Kent Crispin "Be good, and you will be [EMAIL PROTECTED]

Re: Global PKI on DNS?

2002-06-12 Thread Stephen Kent
At 1:15 PM -0400 6/12/02, Keith Moore wrote: I don't want to discount the importance of cert discovery, but I do think it's a stretch to believe that you're going to be willing to trust all of the certs that you discover in a chain of significant length, for a significant set of

Re: Global PKI on DNS?

2002-06-13 Thread Stephen Kent
At 10:42 PM -0700 6/12/02, Einar Stefferud wrote: May I suggest that someone do a little work on proving the trust is transitive, as that is what this is really all about, and if it turns out that trust in not transitive, then what was the point? Maybe if you ask Google about trust

RE: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 12:51 PM -0700 6/13/02, Christian Huitema wrote: A PKI modeled on the DNS would parallel the existing hierarchy and merely codify the relationships expressed by it in the form of public key certs. so what you're saying is that the cert would mean something like: ;-)

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 3:32 PM -0400 6/13/02, Harald Koch wrote: Of all the gin joints in all the towns in all the world, Stephen Kent had to walk into mine and say: Why does everyone keep thinking that explicit trust is an essential element of every PKI? If the reasonably intelligent, technically skilled

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 2:54 PM -0700 6/13/02, Einar Stefferud wrote: At 2:15 PM -0400 6/13/02, Stephen Kent wrote: [snip]... [snip]... [snip]... [snip]... [snip]... [snip]... [snip]... [snip]... You are the one who keeps saying that trust is transitive. I'm the one saying that it's not, and that a DNS-based PKI

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 11:30 PM -0700 6/13/02, Einar Stefferud wrote: [EMAIL PROTECTED] said: On Fri, 14 Jun 2002 10:52:47 +1200, Franck Martin [EMAIL PROTECTED] said: Ideally, we should rate each CA in our applications and the application should give us a level of risk... Hey.. it's the PGP Web of Trust.

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 2:47 PM -0400 6/13/02, Keith Moore wrote: A modest, realistic ambition for a DNS-based PKI would be to improve the security of the binding between DNS entries and the associated machines yes, I think this is right. it eliminates some kinds of threats. but it still doesn't guarantee

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
Ed, Keith Moore wrote: A PKI modeled on the DNS would parallel the existing hierarchy and merely codify the relationships expressed by it in the form of public key certs. so what you're saying is that the cert would mean something like: ;-) actually, to a lawyer, a PKI cert says

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
Ed, Stephen Kent wrote: Ed, snip I think your sample CPS, while more than a little tongue in cheek, is a good example of what a CA may assert. But, in the DNS context, many of the issues you note are much less serious concerns than in a general CA context, because of the existing

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
Stef, Thank You Steve for clarifying your simple little error and correcting the record on what I did or did not say. I admit that the error was small in commission but you must admit that it was huge in affect, so it is good for you to corrected the record. I will assume that it was not

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
At 11:30 AM -0700 6/14/02, Ed Gerck wrote: Stephen Kent wrote: snip Could you elaborate, perhaps privately, with why you believe a true PKI needs multiple roots? snip My view is that too many folks have tried to get too much out of any single PKI, and that has caused a lot of our

Re: Global PKI on DNS?

2002-06-14 Thread Stephen Kent
Stef, Hi Steve -- Now we are beginning to connect with the real meta issue. I am talking about Trust Transitivity in general. We agree that the DNS offers no trust functions, useful or otherwise. So, my focus is not on PKI as related to DNS, which is what you addressed here. It the

Re: Global PKI on DNS?

2002-06-18 Thread Stephen Kent
At 11:03 AM -0500 6/18/02, Alex Audu wrote: Ed, You made some interesting points which leads me to wonder if we can define Trust in such a way that its parameters are verifiable, then we can verify that it is transitive. In other words, if Jon gets a dollar from Mike, and Jon can verify the

Re: Global PKI on DNS?

2002-06-25 Thread Stephen Kent
At 5:25 PM -0700 6/20/02, Ed Gerck wrote: Stephen Kent wrote: Your example does not require cross-certification. It only requires that the relying parties be members of, or have access to the (CA) credentials for, the communities to which the individuals belong. Cross certification is one

Re: Global PKI on DNS?

2002-06-25 Thread Stephen Kent
At 11:58 AM -0400 6/25/02, Keith Moore wrote: We seem to agree that the DNS could be sued to distribute certs, so the question is what should the certs attest to and who should issue them. I argue that we need certs that support validation of DNS bindings, and that the only

Re: IPv6 and child pornographers

2002-10-14 Thread Stephen Kent
Mr. Baptista, In reading your message re the history of security and the Internet I my attention was drawn to the following paragraph: DARPA planners unfortunately were short sighted and did not anticipate the technology would become an international standard for communications.

RE: .p7s attachment

2003-03-12 Thread Stephen Kent
At 9:27 AM +1200 3/13/03, Franck Martin wrote: I think the trouble with this attachment is that the whole e-mail is encrypted in clear (anybody can decrypt) to save space when you send the e-mail (SSL/TLS includes compression). It's not encrypted, it's encoded in a form (base 64) that is unlikely

Re: requiring payment (was spam)

2003-05-31 Thread Stephen Kent
At 1:36 AM -0700 5/29/03, Einar Stefferud wrote: I suggest that those who wish to more fully understand all this trust stuff might find it useful to look at http://mcg.org.br/. Cheers...\Stef I would recommend this web site only to folks who want to see a very narrow view of what trust and

Re: requiring payment (was spam)

2003-06-03 Thread Stephen Kent
At 3:10 PM -0700 5/30/03, Einar Stefferud wrote: Pity the poor Zealot; who, when he loses sight of his objective, simply redoubles his efforts. For sure, do not let any new ideas leak into the IETF! Cheers...\Stef Pity the poor fellow who ventures outside his realm of knowledge and then

Re: Pretty clear ... SIP

2003-08-25 Thread Stephen Kent
At 19:03 -0700 8/23/03, Karl Auerbach wrote: On Sat, 23 Aug 2003, Dean Anderson wrote: H.323 and ASN.1 eventually surpass ... Ummm, based on my own direct experience with ASN.1 since the mid 1980's (X.400, SNMP, CMIP...), I disagree. It has been my experience that ASN.1, no matter which encoding

RE: ITU takes over?

2003-12-12 Thread Stephen Kent
At 8:39 -0800 12/12/03, Tony Hain wrote: vinton g. cerf wrote: ... Unfortunately, the discussion has tended to center on ICANN as the only really visible example of an organization attempting to develop policy (which is being treated as synonymous with governance To further your point, an area

Re: PKIs and trust

2003-12-15 Thread Stephen Kent
Keith, I've authored several papers that capture what I see as the essence of your characterizations, in a simple form. The central notion is that most of these relationships are NOT about trust, but rather about authority. if one views them in this fashion, then it becomes apparent that the

Re: PKIs and trust

2003-12-15 Thread Stephen Kent
At 4:31 +0900 12/16/03, Masataka Ohta wrote: Stephen Kent; I've authored several papers that capture what I see as the essence of your characterizations, in a simple form. The central notion is that most of these relationships are NOT about trust, but rather about authority. if one views them

Re: PKIs and trust

2003-12-15 Thread Stephen Kent
At 6:08 +0900 12/16/03, Masataka Ohta wrote: Stephen Kent; I'm having a feeling that you call a set of software/hardware to handle certs a PKI. no, there is a lot more to a PKI than hardware and software. The problem for such PKI is that, if we have certs based on existing trust (e.g. I trust

Re: Visa for South Korea

2003-12-30 Thread Stephen Kent
At 11:34 -0500 12/30/03, Ken Hornstein wrote: From my reading of the Korean Embassy web page, it seems that US residents will require a visa to attend the Seoul IETF. I'm wondering if anyone has gotten a visa to enter South Korea before, and if so, can they provide any tips on the visa process?

Re: TCP over IPSec ESP??

2004-02-23 Thread Stephen Kent
. ESP is not generaly run over TCP. RFC 2402 describes the use of ESP. Steve Kent author of 2401, 2402, 2406, ...

UA 893 compensation

2004-03-05 Thread Stephen Kent
Thius is a note for all of the folks who flew on UA 893 on Friday, 2/27, with the unexpected 24 hour delay via Seattle. I just got off the phone with UA Customer Service (not Mileage Plus). They offered a 5K mile good will compensation for our inconvenience. These miles will not count toward

Re: UA 893 compensation

2004-03-05 Thread Stephen Kent
At 12:40 -0500 3/5/04, John C Klensin wrote: --On Friday, March 05, 2004 11:26 -0500 Stephen Kent [EMAIL PROTECTED] wrote: Thius is a note for all of the folks who flew on UA 893 on Friday, 2/27, with the unexpected 24 hour delay via Seattle. I just got off the phone with UA Customer Service

RE: E911 location services (CAS system too)

2004-06-13 Thread Stephen Kent
Harald, You are right that the scheme I proposed inn 1422 did not succeed, and today I would not suggest it. But, the reason I would not suggest it today is because I have come to believe that one should adopt CAs that are authoritative for the certs they issue, not trusted third parties. The

Re: Voting (again)

2005-04-16 Thread kent crispin
of this thread is vacuous. -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED] ___ Ietf mailing list Ietf@ietf.org https://www1.ietf.org/mailman/listinfo/ietf

Re: When to DISCUSS?

2005-07-11 Thread Stephen Kent
Yakov, Ultimately the marketplace will decide, but when a WG provides multiple solutions to the same problem it has the potential to confuse the marketplace, retard adoption of any solution, interfere with interoperability, etc. Standards ought to avoid confusion, not contribute to it.

RE: Port numbers and IPv6(was: I-D ACTION:draft-klensin-iana-reg-policy-00.txt)

2005-07-19 Thread Stephen Kent
At 2:35 PM -0700 7/19/05, Hallam-Baker, Phillip wrote: Host and application security are not the job of the network. They are the job of the network interfaces. The gateway between a network and the internetwork should be closely controlled and guarded. Nobody is really proposing embedding

RE: Port numbers and IPv6(was: I-D ACTION:draft-klensin-iana-reg-policy-00.txt)

2005-07-20 Thread Stephen Kent
Phil, ... Boy are you in for a shock when you try to connect to an ethernet with 802.1x. I have yet to do so. I do have the facility on my Mac, but I've never had to turn it on. Authentication is being built into the NIC cards. At some point in the future it will not be possible for any

RE: Port numbers and IPv6(was: I-D ACTION:draft-klensin-iana-reg-policy-00.txt)

2005-07-20 Thread Stephen Kent
Phil, layered defenses are a good notion, but mostly when the layers are under the same administrative control. all too often people forget that relying on the security provided by someone else is a risky proposition, as in your example of ISPs providing ingress filtering. I would

Re: what is a threat analysis?

2005-08-10 Thread Stephen Kent
Dave Michael, In the DoD environment, a threat analysis for a system identifies the classes of adversaries that the author believes are of concern, and describes their capabilities and motivations. Russ's three questions are a concise way of stating this: - The bad actors are

Re: what is a threat analysis?

2005-08-11 Thread Stephen Kent
Folks, I thought that what Russ asked for was not a threat analysis for DKIM, but a threat analysis for Internet e-mail, the system that DKIM proposes to protect. The idea is that only if we start with a characterization of how and why we believe adversaries attack e-mail, can we evaluate

Re: what is a threat analysis?

2005-08-12 Thread Stephen Kent
At 3:08 PM -0700 8/11/05, Ned Freed wrote: I thought that what Russ asked for was not a threat analysis for DKIM, but a threat analysis for Internet e-mail, the system that DKIM proposes to protect. The idea is that only if we start with a characterization of how and why we believe adversaries

Re: UN

2005-09-29 Thread kent crispin
system than just human sentiment. There is heavy duty infrastructure, both human and physical, involved. -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED] ___ Ietf mailing list Ietf

Re: On PR-actions, signatures and debate

2005-10-06 Thread kent crispin
it happen many times. -- Kent Crispin [EMAIL PROTECTED] ___ Ietf mailing list Ietf@ietf.org https://www1.ietf.org/mailman/listinfo/ietf

Re: Diagrams (Was RFCs should be distributed in XML)

2005-11-14 Thread kent crispin
currently available. The clearest methods currently available might include visio diagrams or powerpoint slides -- at least according to some people. -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED

Re: EARLY submission deadline - Fact or Fiction?

2005-11-29 Thread kent crispin
case. Kent -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED] ___ Ietf mailing list Ietf@ietf.org https://www1.ietf.org/mailman/listinfo/ietf

Re: FW: IETF Last Call under RFC 3683 concerning JFC (Jefsey) Morfin

2006-01-22 Thread kent crispin
to believe themselves smart. Would that things were so simple. -- Kent Crispin [EMAIL PROTECTED]p: +1 310 823 9358 f: +1 310 823 8649 [EMAIL PROTECTED] SIP: [EMAIL PROTECTED] ___ Ietf mailing list Ietf@ietf.org https://www1.ietf.org/mailman

Re: Fwd: TLS authorizations draft

2006-05-22 Thread Stephen Kent
At 10:16 AM -0400 5/18/06, Russ Housley wrote: I received this note from Angelos Keromytis regarding the draft-housley-tls-authz-extns document. I plan to accommodate this request unless someone raises an objection. Russ OK, I'll object :-). KeyNote has no IETF status, to the best of my

RE: [TLS] Review of draft-housley-tls-authz-extns-05

2006-05-24 Thread Stephen Kent
Russ, I concur with Pasi's observations. I don't recall seeing a similar structure in an RFC, where a part is informative, in what is otherwise a standards track document. Steve ___ Ietf mailing list Ietf@ietf.org

Re: Last Call: 'A Lightweight UDP Transfer Protocol for the the Internet Registry Information Service' to Proposed Standard (draft-ietf-crisp-iris-lwz)

2006-08-16 Thread kent crispin
-drive, cli client I wrote and it doesn't retransmit at all (perhaps not the best UI experience). I'll check with the other implementers to see what they did. But you are right, guidance needs to be given, especially if these things get embedded into automated scripts. s/if/when/ -- Kent

Re: Questions on my role as the 2007-8 nomcom chair and the various discussions on the IETF list

2007-06-14 Thread Stephen Kent
At 12:29 AM -0700 6/13/07, Lakshminath Dondeti wrote: Folks, One person has voiced concerns on my taking a strong public position in the Should I* opinions be afforded a special status? thread while serving as the chair of the 2007-8 nomcom. Perhaps there are others with similar concerns.

Re: PKI is weakly secure (was Re: Updating the rules?)

2007-07-09 Thread Stephen Kent
At 6:36 PM +0900 7/7/07, Masataka Ohta wrote: Keith Moore wrote: Also from the draft: At least for the strong security requirement of BCP 61 [RFC3365], the Security Area, with the support of the IESG, has insisted that all specifications include at least one mandatory-to-implement strong

Re: PKI is weakly secure

2007-07-10 Thread Stephen Kent
At 10:54 AM +0900 7/10/07, Masataka Ohta wrote: ... Stephen Kent wrote: The notion of CA compromise and ISP comprise are not completely comparable, which makes your comparison suspect. As I already mentioned, social attacks on employees of CAs and ISPs are equally easy and readily

Re: PKI is weakly secure (was Re: Updating the rules?)

2007-07-10 Thread Stephen Kent
At 1:13 PM -0700 7/10/07, Douglas Otis wrote: On Jul 8, 2007, at 10:34 PM, Eliot Lear wrote: This can be said of any technology that is poorly managed. So, you merely believe that the infrastructure of PKI is well managed. In all but a single instance I have no evidence to the contrary.

Re: IPv4

2007-08-08 Thread Stephen Kent
At 4:36 PM +0200 8/8/07, Iljitsch van Beijnum wrote: On 8-aug-2007, at 12:07, Harald Alvestrand wrote: Routing certificates are simple. If HP sells (lends, leases, gifts, insert-favourite-transaction-type-here) address space to someone, HP issues a certificate (or set of certificates) saying

Re: draft-shirey-secgloss-v2-08.txt

2007-08-09 Thread Stephen Kent
At 9:32 AM -0400 8/9/07, David Harrington wrote: Hi, The issue was raised during ISMS WGLC that there is a difference between our use of the word authenticate and the glossary in RFC2828. Since ISMS extends SNMPv3, ISMS is using terminology consistent with the SNMPv3 standard, which reflects

Re: IPv4

2007-08-09 Thread Stephen Kent
At 6:35 AM -0700 8/9/07, Bill Manning wrote: ... The RIRs are working to enable clean transfer of address space holdings, using X.509 certs. While one could do what what Harald suggested, the new address space holder would have to worry about HP revoking the cert it issued to effect the

Re: IPv4

2007-08-09 Thread Stephen Kent
At 9:03 AM -0700 8/9/07, Bill Manning wrote: ... The RIRs are recognized as neutral, primary address space allocators who have contractual relationships with the folks to whom they allocate addresses. I think it might be more attractive to the new holder of address space to have a

Re: IPv4

2007-08-09 Thread Stephen Kent
At 11:40 AM -0700 8/9/07, Bill Manning wrote: O... ICANN is also a legal entity, with the same vulnerabilities as all other companies including RIR's... which was my point. Special is reserved for governments... :) The U.S. Dept. of Commerce recognizes ICANN

Re: Review of draft-hartman-webauth-phishing-05

2007-08-22 Thread Stephen Kent
Henning, Some WGs issue Informational RFCs that represent WG consensus, but which are not viewed as suitable Standards track documents, for various reasons. For example, RFC 3647 is one of the most widely cited of the PKIX RFCs, yet it is Informational because its a policy and procedures

RE: The Internet 2.0 box Was: IPv6 addresses really are scarce after all

2007-08-23 Thread Stephen Kent
At 11:23 AM -0700 8/23/07, Hallam-Baker, Phillip wrote: If we can meet the needs of 80% of Internet users with some form of shared access there will be more addresses left for the 20% with greater needs. I suspect that the actual percentages are more like 95% and 5%. My Internet use is

Re: [PMOL] Re: A question about [Fwd: WG Review: Performance Metrics atOther Layers (pmol)]

2007-11-14 Thread Stephen Kent
Joe, I disagree with your suggestion The software performance of security protocols has been the more substantial issue, and is likely to continue to be for the forseeable future. I suspect that most desktop users do not need hardware crypto for performance. Irarely if ever drive my GiGE

Re: [PMOL] Re: A question about [Fwd: WG Review: Performance Metrics atOther Layers (pmol)]

2007-11-15 Thread Stephen Kent
Joe, This discussion seems to have moved from a discussion of crypto use on home/office computers, to use in routers. There is no good motivation for other than edge (CPE?) routers to make use of IPsec for subscriber traffic. We know, from discussions with operators, that use of IPsec to

Re: Last Call: draft-ietf-pkix-rfc3280bis (Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile) to Proposed Standard

2007-12-03 Thread Stephen Kent
Sam Hartman identified an issue with one name type (URI) that may appear in the Subject/Issuer alternative names, when applying the Name Constrains extension to such names. The issue arises when the URI does not contain an authority component (a host name in a DNS name or e-mail address),

Re: Last Call: draft-shimaoka-multidomain-pki-11.txt

2007-12-04 Thread Stephen Kent
At 7:34 PM +0100 12/4/07, Martin Rex wrote: The document - 'Memorandum for multi-domain Public Key Infrastructure Interoperability' draft-shimaoka-multidomain-pki-11.txt as an Informational RFC creates the impression that trust anchors must always be self-signed CA certificates.

review comments on draft-ietf-btns-prob-and-applic-06.txt

2008-01-07 Thread Stephen Kent
I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just

RE: Last Call: draft-klensin-net-utf8 (Unicode Format for Network Interchange) to Proposed Standard

2008-01-09 Thread Kent Karlsson
Comment on draft-klensin-net-utf8-07.txt: -- Network Virtual Terminal (NVT) occurs first in Appendix A. The explanation of the abbreviation should (also) be given at the first occurence of NVT in the document. -- Section 2, point 2,

RE: Last Call: draft-klensin-net-utf8 (Unicode Format for Network Interchange) to Proposed Standard

2008-01-10 Thread Kent Karlsson
on page 4) for NFC in Net-UTF-8 applies. The reciever cannot be sure that NFC has been applied. Nor can it be sure that conversion of all line endings to CR+LF (there-by loosing information about their differences) has been applied. /kent k ___ Ietf

RE: Last Call: draft-klensin-net-utf8 (Unicode Format for NetworkInterchange) to Proposed Standard

2008-01-10 Thread Kent Karlsson
. /kent k This interpretation was also, I believe, incorporated by Jon Postel in the rules for NVT and for RFC formatting. I can't believe I am reopening this old topic... ;-( Bob Braden ___ Ietf mailing list Ietf@ietf.org https://www1

RE: Last Call: draft-klensin-net-utf8 (Unicode Format for Network Interchange) to Proposed Standard

2008-01-14 Thread Karlsson, Kent
that, we could also do away with the entire next line debate by prohibiting even CRLF and requiring the use of LS LS would be a bad idea. See my other email (sent at approx. the same time as this one). You would get (to you) unexpected effects from bidi processing. /Kent Karlsson

RE: Last Call: draft-klensin-net-utf8 (Unicode Format for Network Interchange) to Proposed Standard

2008-01-14 Thread Karlsson, Kent
to beginning of line). If it were not for that, I would agree that VT is not very interesting (though it does provide for a hack to distinguish line separation from paragraph separation by ignoring the tabulation aspect of VT, also for pure 8-bit character encodings). /Kent Karlsson

Re: [anonsec] review comments on draft-ietf-btns-prob-and-applic-06.txt

2008-01-14 Thread Stephen Kent
At 6:00 PM -0600 1/11/08, Nicolas Williams wrote: ... Finally, multi-user systems may need to authenticate individual users to other entities, in which case IPsec is inapplicable[*]. (I cannot find a mention of this in the I-D, not after a quick skim.) [*] At least to my reading of RFC4301,

Re: [anonsec] review comments on draft-ietf-btns-prob-and-applic-06.txt

2008-01-14 Thread Stephen Kent
At 2:06 PM -0600 1/14/08, Nicolas Williams wrote: ... Ipsec does support ^ You're slipping :) :) oh my! per-user authentication if protocol ID and port pairs can be used to distinguish the

Re: Thoughts on the nomcom process

2008-03-17 Thread Stephen Kent
Mike, I have to disagree with your characterization of the proper role of the IAB with regard to the NOMCOM process. I have been on three NOMCOMs, including the one prior to this, so I too have some experience in the process. My feeling is that the IAB may have been trying to assert too

RE: RNET: Random Network Endpoint Technology

2008-06-23 Thread Stephen Kent
Chad, Your message of 4/8 ended with a list of changes needed to IPv6 implementations to implement RNET. Changes to processing logic are just as serious as change to the format. Steve --- The following changes need be made to the IP Version 6 Protocol Logic, in routers, in order to

Re: how to contact the IETF

2009-02-09 Thread Stephen Kent
Alex, The conclusion I draw from this experience differs from yours. If the individuals who sent the messages in question choose to become involved constructively, then there can be some benefit. But, the act of sending the messages in question has generated ill will, so it was a bad way to

RE: Comments requested on recent appeal to the IESG

2009-02-20 Thread Stephen Kent
At 9:00 PM -0800 2/19/09, Hallam-Baker, Phillip wrote: Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary=_=_NextPart_001_01C99318.3582B8D8 Just as a matter of observation, there is not and never has been a security requirement to rigidly

Re: Comments requested on recent appeal to the IESG

2009-02-21 Thread Stephen Kent
At 7:06 PM -0800 2/20/09, Dave CROCKER wrote: Stephen Kent wrote: At 9:00 PM -0800 2/19/09, Hallam-Baker, Phillip wrote: Just as a matter of observation, ... ... I have not read the doc in question,... Hey guys. As someone who is frequently faced with trying to parse out what

  1   2   >