Re: Telnet encryption

[John Gardiner Myers <[e-mail]>]

"Richard Basch" <[e-mail]> writes:
> In some cases, it may employ the keys that were
> negotiated during the authentication option, but a combined option
> should not be designed that inhibits the use of encryption without
> authentication.

The issue is not so much encryption as integrity protection of the
authenticated connection.  If a client is willing to authenticate a
connection to be used without integrity protection, the negotiation of
its willingness to do without integrity protection must be integrity
protected.

An authentication protocol which does not allow a client to make its
authentication conditional upon the integrity protection of the
connection is simply unacceptable.

It just so happens that for Telnet, the only integrity protection
people are interested in is encryption.

As for "inhibiting the use of encryption without authentication", one
could define an "authentication" mechanism, such as Diffie-Hellman,
which is only able to "authenticate" the anonymous identity.

-- 
_.John G. Myers		Internet: [e-mail]
			LoseNet:  ...!seismo!ihnp4!wiscvm.wisc.edu!give!up