Authentication/encryption services don't have to be directly provided by the
logging system itself, but the logging system must have enough intimate contact to
guarantee that logs are only going to where they're supposed to and that logs came
from where they were supposed to.
Also, the logging system has to be part of the system's "Trusted Computing Base" or
the log system itself can be attacked. If the authentication/encryption element is
separate, than this piece has to be in the "Trusted Computing Base" too.
Kriss Andsten wrote:
> On Wed, 20 Oct 1999, Magosanyi Arpad wrote:
>
> <snip'ing the reason for which this is exactly the same.. eeh.>
> >
> > For the exact same reason we should investigate the possibility of having
> > SSL as the crypto layer of transmission.
>
> Is there any reason what-so-ever for SSL (or whatnot) to be implemented on
> the protocol level? There's all kinds of security requirements, ranging
> from 'eh?' to strong encryption. Sure pluggable wrappers (got SSL on the
> other end? No. Okay, gzip then? No. Ah. I'll just send plaintext then..)
> negotiated at connect time would be a neat thing, and pretty flexible, but
> any -extraneous- support.. would it be sane to put it in the protocol
> rather than elsewhere?
>
> Kriss
>
> --- .... --..-- -.-- --- ..- .-. . .- -.. -- --- .-. ... . --..-- . .... ..--..
> Kriss Andsten <[EMAIL PROTECTED]> telnet slartibartfast.vogon.se 4243
--
Chris Calabrese
Internet Infrastructure and Security
Merck-Medco Managed Care, L.L.C.
[EMAIL PROTECTED]
.
