Subject: Re: ssh
To: RJ Atkinson <rja@inet.org>
From: Simon J. Gerraty <sjg@quick.com.au>
List: tech-security
Date: 12/17/2000 23:50:09
>>I've been told that strong, user-level encryption 
>>is available to telnet. 

>        It is not clear to me that the above is generally true,
>even if I knew what the author above meant by "strong" or 
>"user-level" in this context.

Not sure what "he" meant either, but SSL telnet (eg my stelnet)
provides authentication via X.509 certs (typically 1K), 
with support for CRL's etc - much better situation that the 
RSA authentication in SSHv1, and stream ciphers (pick your favourite)
with 256bit keys.

This is "user-level" security in that the telnetd knows if it gets 
connection the level of security it offers.  With say link level
security its often a false sense of security.

>        There were several different research projects on that, 
>but none was ever widely available.   It is not clear to me 
>whether any of the Telnet security enhancements provided security. 

Oh?  Don't know which ones you are thinking of, but I'm pretty sure
stelnet did the job.

But as I said in my first post - which I failed to cc to the list
I use SSH just as much or more than the SSL based tools I wrote,
because SSH has features that I didn't want in those more restrictive
tools but find handy in many envs - eg X forwarding ;-)
And lets face it - everyone uses SSH.

The biggest problem with "secure" telnet - as you noted, is lack of
standardization.

--sjg