> > Good security requires state.
>
> I don't understand this. _Efficient_ security may require state, but
> using a distinct and unpredictable session key for every stateless
> transaction is surely entirely secure.
First, good security is efficient security. Second, in order to securely
exchange session keys, you have to use the "login key" of the parties.
This means the login key (e.g., private key, or passphrase-to-3DESkey)
has to be available for every transaction. This means its exposed more.
This means it's less secure.
It would be as if the Unix shell required you to enter you password each
time you entered a command line.
/r$
--
Rich Salz Chief Security Architect
DataPower Technology http://www.datapower.com
XS40 XML Security Gateway http://www.datapower.com/products/xs40.html
XML Security Overview http://www.datapower.com/xmldev/xmlsecurity.html
