RE: Gauntlet & NTLM

["Marcus J. Ranum" <mjr () nfr net>]

> PPTP uses PPP's security extensions to encrypt the tunnel. You should
> be looking at the PPP RFC's or drafts.

Ah! That's an interesting situation. Does anyone actually *implement*
the PPP RFCs for security? I know that there are all kinds of useful
things in the RFC but I don't think, for example, that my W95 PPP
stack supports encryption.

[A general class of security problems occurs when one layer rests
on another and the lower layer's security properties have not yet
been implemented or contain flaws. I can imagine an un-funny
situation in which PPTP doesn't do encryption and authentication
because that's PPP's problem, and PPP doesn't do encryption
because that's IPSEC's problem, and IPSEC isn't available.]

mjr.

--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr