Re: [TLS] Security concerns around co-locating TLS and non-secure on same port (WGLC: draft-ietf-tsvwg-iana-ports-08)

[Nicolas Williams <[e-mail]>]

On Mon, Nov 08, 2010 at 05:07:42PM +0800, Paul Hoffman wrote:
> At 6:46 PM +1300 11/8/10, Peter Gutmann wrote:
> >What is this claim based on?
> 
> "some security issues": See the long Security Considerations section on RFC 3207.

In-band (StartTLS) and out-of-band (separate ports) negotiation have
almost the same overall security considerations regarding downgrades.
One difference, for example: in the in-band case the client has to re-do
any other negotiations after starting TLS, if it did do any other
negotiations -- but this is easily avoided by doing no other
negotiations prior to starting TLS.  The fact that the former are
documented where the in-band negotiation protocol may be misleading some
to believe that the out-of-band negotiation is much safer than in-band.

> "be complexer to implement than using two ports": See the state
> machine described in section 4 and its subsections in RFC 3207. That's
> much more complex than "OK, let's go".

This is true.  Specifically it complicates the task of making the
security layer transparent to the application.  But really, not _that_
much.  Most StartTLS protocols involve an in-band negotiation of whether
to start TLS, then a switch to raw TLS (as opposed to encapsulating TLS
records in the application protocol's message framing) followed by
continuing the application protocol over raw TLS -- not very
complicated, even for implementations that use external processes to
handle the TLS security layer.

> "thus less popular": Developers would like fewer code paths and more
> failure states.

Maybe the lack of popularity has more to do with StartTLS requiring a
smidgen more thought and design than raw TLS of port XYZ :)

OTOH, we've seen requests for StartTLS support in some applications
where the user preferred StartTLS.  So popularity is in the eye of the
beholder.  For example, more TCP ports -> more firewall rule complexity.
Yes, opening the regular port requires a leap of faith that StartTLS
will be used, but if the firewall admin can ensure that the servers
implement and require StartTLS, then fewer ports -> simpler.

Nico
--