Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Nicolas Williams <[e-mail]>]

On Mon, Nov 08, 2010 at 09:57:59PM +0100, Richard Hartmann wrote:
> On Mon, Nov 8, 2010 at 21:12, Nicolas Williams
> <[e-mail]> wrote:
> 
> > For example, more TCP ports -> more firewall rule complexity.
> > Yes, opening the regular port requires a leap of faith that StartTLS
> > will be used, but if the firewall admin can ensure that the servers
> > implement and require StartTLS, then fewer ports -> simpler.
> 
> Let's assume only StartTLS/TLS is allowed at a site:
> 
> One overloaded port:
>   firewall: one open port
>   daemon: extra configuration to disallow non-TLS
> 
> Two ports:
>   firewall: one open port as the non-TLS port is blocked
>   daemon: default config which allows TLS, only
> 
> Personally, I prefer a distinct port as, assuming no one is doing
> anything funny, it does more to ensure encryption than overloading a
> single port. And yes, this does not guarantee anything. But then, as
> we all know, security is not measured in absolutes. It's a sliding
> process.

If the firewall is not close to the client then the client can still
fallback on no TLS.

There's trade-offs all over.  I'm not sure that this one is worth all
that much either way.  I prefer StartTLS over having two ports for
everything.  I might also be happy with forcing TLS on always for new
ports, but I do worry about training users to click through the
"is this the right server" dialog ("leap-of-faith").

Nico
--