Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Yoav Nir <[e-mail]>]

On Nov 9, 2010, at 6:28 PM, t.petch wrote:

> Michael
> 
> Yes there was a smiley but there is also a serious point.
> 
> I recently was involved in syslog over TLS and the RFC there explicitly calls it
> out.  Diagnostic messages are good for diagnosing problems and so should be sent
> in the clear unless there is a reason to do otherwise (eg relating to security
> breaches, password misuse etc) and this is a general truth in operations (SNMP
> etc).  Yes, I must have integrity, but privacy can be a real pain, stopping the
> determination of problems.

Nobody is forcing privacy down your throat. Just as IPsec has AH and ESP-NULL, TLS has TLS_RSA_WITH_NULL_SHA256 and TLS_ECDHE_ECDSA_WITH_NULL_SHA among others.

Browsers don't offer this ciphersuite, and for good reason, as Nicolas pointed out. But they may be good for other protocols.