Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Richard Hartmann <[e-mail]>]

On Mon, Nov 8, 2010 at 21:12, Nicolas Williams
<[e-mail]> wrote:

> For example, more TCP ports -> more firewall rule complexity.
> Yes, opening the regular port requires a leap of faith that StartTLS
> will be used, but if the firewall admin can ensure that the servers
> implement and require StartTLS, then fewer ports -> simpler.

Let's assume only StartTLS/TLS is allowed at a site:

One overloaded port:
  firewall: one open port
  daemon: extra configuration to disallow non-TLS

Two ports:
  firewall: one open port as the non-TLS port is blocked
  daemon: default config which allows TLS, only

Personally, I prefer a distinct port as, assuming no one is doing
anything funny, it does more to ensure encryption than overloading a
single port. And yes, this does not guarantee anything. But then, as
we all know, security is not measured in absolutes. It's a sliding
process.


Richard