Subject: CAP issue: workflow path may not be a true path

From: [email-masked] (Steve Mansour)
Date: Thu, 19 Jul 2001 10:16:40 -0700

Here are the issues:

    The workflow path may not be a true path:

     The iTIP workflow path was a just that; a path (msg flow out
     followed same logical flow back).  In CAP, if 'rerouting' over
     iTIP occurs then the path is now a loop (CUA1->CS1->iTIP to
     MUA2/CUA2->MUA1/(CUA1?).  The last leg of getting iTIP/iMIP
     replies from the MUA1 to CUA1 so it can stuff them into   CS1
     in the "proper place" is just handwaved (or "left up to the
     user or their tools to do"). There is no clear why/how CUA1
     would stuff in iTIP/iMIP messages into own queue instead of
     having CUA1 watch the incoming MUA1 queue for iTIP msgs and
     pulling them in or having CS1 rewrite the address so that msgs
     return to it directly.

     Users may be confused (at best) or not aware of (at worse) any
     kind of signature msgs / warnings that they may
     see on their receiving end.  Email may still be ok in that if
     my
     MUA can see the sig then it tells me "This msg was signed by
     Doug Royer and its valid".  He does not think there is any
     usefulness in seeing "This request   was signed and I, your
     trusted CS says its valid!" (esp. if we allow downstream
     servers to sign 'on your behalf' or 'at your behest' via some
     TBD mechanism).  Is data integrity within the CS necessary? Do
     we trust the CS to enforce integrity or not.

In the interest of moving CAP along, I'm going to recommend that the CS
does not attempt to do this sort of data integrity checking. I think
it's a great idea. I think it's a good goal.  My gut tells me

   * we will be spending a *long* time trying to nail it in the first
     version of CAP
   * I think trying to work out the signing and identity mapping between
     different vendors and even between the same vendors tools but at
     different company sites is going to be a difficult thing to nail.
   * as a practical matter, we all receive many email messages that are
     not authenticated and that affect how we schedule our time. I just
     got one, "sman, we need to review your department budget. Let's
     meet Monday at 11:30...".

I think CAP will be extremely useful even in the absence of this data
integrity checking. Implementations can do it on their own and maybe
even write up supplemental drafts to tell us how to do it for CAP.

I think we should just acknowledge this as a possible security problem
and move forward.

Thoughts?

-Steve