1. IETF sec - 1 Security Work in the IETF Scott Bradner Harvard University sob@harvard.edu

2. IETF sec - 2 Syllibus u IETF security “rules” u security at the IP layer u security above the IP layer u key distribution u applications u summary

3. IETF sec - 3 IETF Security Rules u all RFCs must have a meaningful (in context) Security Considerations section not always the case with old RFCs u most IETF charters say that security must be addressed as a basic issue u security ADs carefully review security issues with documents offered for publication as RFCs u note: “security” includes integrity, confidentiality, privacy, scalability, reliability,...

4. IETF sec - 4 IETF Security Rules, contd. u most applications must have a mandatory-to- implement security option can negotiate alternatives u working group can not assume that the technology will be only used in a confined environment e.g., IP storage - not just the glass house anymore u authentication & confidentially must be addressed u can not overload TCP port 80 can not piggyback on the web getting through a firewall by the way RFC 3093 is a joke

5. IETF sec - 5 Security at the IP Layer u IPsec IETF packet-level authentication & encryption u best implemented in OS Kernel u can provide protection to all applications can live under legacy applications u mostly used in VPN applications and between firewall products

6. IETF sec - 6 Security above Transport u SSL/TLS TLS: IETF “Transport Layer Security” protocol u can be implemented in an application does not require OS support comes from history - Netscape could not depend on OS u perhaps the most used security technology on the Internet used by browsers everyday to do commerce on the Internet

7. IETF sec - 7 SSL/TLS, contd. u integration into Browser makes it invisible to end- users this is a Good Thing ™ u TLS is "good enough” to have displaced “better” solutions e.g., Secure Electronic Transaction (SET) standard designed by Visa and Mastercard

8. IETF sec - 8 Key Distribution, a Big Problem u “big” in that it requires infrastructure infrastructure is hard to deploy u IETF PKIX Group is profiling X.509 for use in the Internet largest user: TLS u DNS Security may also be used for Key Distribution some day problems deploying it so far u will DNS be our Key Management System or will PKIX? jury still out

9. IETF sec - 9 Applications u secure mail: SMIME & PGP/MIME Key Distribution is still a problem user applications are available, but hard to use hope to see some real deployment as people realize the need to secure email u SMIME & TLS used to secure IETF VoIP signaling u TLS used for many applications PKIX, LDAP, BEEP, SASL, L2TP, SMTP,...

10. IETF sec - 10 Summary & Problems u IETF demands “good” security u standard development community is reluctant sometimes u users seen as not wanting security tell that to the feds