Re: [saag] Additions to RFC 3631?

[Joe Touch <[e-mail]>]

On 5/21/2012 11:27 AM, Nico Williams wrote:
> On Mon, May 21, 2012 at 1:23 PM, Yaron Sheffer<[e-mail]>  wrote:
>> Trying my best to be unpopular:
>>
>> Much as I like the concept of BTNS, it hasn't caught on. I see this RFC as
>> providing useful guidance to practitioners, and non-existent technology
>> doesn't cut it.
>
> Hey, I said it too.
>
>> On the other hand, SSH "leap of faith" is very close to BTNS, and should in
>> fact be mentioned in the paragraph that discusses SSH. In the context of
>> SSH, "leap of faith" is much more innovative than what the current text
>> focuses on.
>
> Right.  But note that for me BTNS was not about leap-of-faith, though
> that was a key selling point for some.  For me BTNS was about
> anon-anon channels that could be bound into app-layer authentication.

Or useful even without further authentication - by raising the effort of 
an attacker -- i.e., attacks need to do the work of a flash-crowd; 
merely tossing RSTs at TCP connections wouldn't work under BTNS, even 
without tying security at that connection to another layer. And that 
sort of protection is possible without *any* KMI.

Joe