Re: SSL vs. VPN

[Larry Bolhuis <lbolhuis@xxxxxxxxxx>]

> > You don't.  VPN open a secure door to your entire network.  SSL open a
> > secure path to a peculiar service.  SSL open the door to the public in
> > a way
> > that no-one can (hopefully) decipher.  VPN is more private and thus
> > more
> > secure. You only issue certificates to those you know and trust,
> > hopefully.

    Generally true, however you can use certificates for SSL as well but
they are not required. Also VPN can be done without certificates.

> > Someone listening at the begging of a SSL session can potentially get
> > your keys and decrypt your whole session.

    Not neccesarily true. Depends on the SSL implementation. If you use
certificates, as Client Access does with the AS/400, then there is no
more exposure than with VPN. If you are establishing an SSL connection
with a 'secure' site (such as for Credit card payments) then this is
true. (although unlikely).

>         [Tim McCarthy]  Huh? You were right up to the part when you said
> that SSL was a secure path to a service.

  Nope, service is correct.  For example, I can set up SSL in Client
Access for the entire connection. Then I can go into the 5250 session
and select NO for encryption. That service (telnet) is then not
secured.  In other words you can secure one service and not another
between the same two devices.

  - Larry


-- 
Larry Bolhuis
Arbor Solutions, Inc.
(616) 451-2500
(616) 451-2571 -fax
lbolhuis@arbsol.com
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To subscribe to this list send email to MIDRANGE-L-SUB@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---