RE: [Isms] Comments on draft-ietf-isms-secshell-07.txt

Hi,

I am of the impression that implementers can encrypt their own storage
of the password, so I don't see "require" or "leave" as accurate. How
about,

"At some point during the processing, these mechanisms require the
password be made available as cleartext on the device ... which might
introduce ...".

dbh

> -----Original Message-----
> From: David B. Nelson [mailto:d.b.nelson@comcast.net] 
> Sent: Wednesday, June 27, 2007 5:59 PM
> To: isms@ietf.org
> Subject: [Isms] Comments on draft-ietf-isms-secshell-07.txt
> 
> In section 3.1.3:   
> 
>    It is also possible to use a different
>    password validation protocol such as CHAP [RFC1994] or digest
>    authentication [RFC 2617, draft-ietf-radext-digest-auth-04] to
>    integrate with RADIUS or Diameter.  These mechanisms leave the
>    password in the clear on the device that is authenticating the
>    password which introduces threats to the authentication
>    infrastructure.
> 
> Note that draft-ietf-radext-digest-auth-04 has been published 
> as RFC 4590.
> This is currently under revision, to fix a couple or errors, as
> draft-ietf-radext-rfc4590bis-01.txt.
> 
> In the second sentence I would recommend changing "leave" to 
> "require".
> 
> 
> 
> 
> _______________________________________________
> Isms mailing list
> Isms@lists.ietf.org
> https://www1.ietf.org/mailman/listinfo/isms
> 

_______________________________________________
Isms mailing list
Isms@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/isms