Subject: RE: I-D Action: draft-zuccherato-9798-3-sasl-00.txt

From: "Paul Leach" <[email-masked]>
Date: Fri, 9 Jun 2000 13:14:54 -0700

> -----Original Message-----
> From: Magnus Nystrom [mailto:[email-masked]]
> Sent: Friday, June 09, 2000 3:04 AM
> To: John Myers
> Cc: Robert Zuccherato; [email-masked]
> Subject: Re: I-D Action: draft-zuccherato-9798-3-sasl-00.txt
> 
> 

> The TLS endpoint isn't always the same as the application endpoint and
> that is the very reason for this proposal. Maybe this should 
> be made more
> explicit in the draft.

Why not? What stops any app that would use the proposed new
authentication protocol from making the two end points the same and
using TLS instead?

In fact, nothing does.

Paul

---

From: Magnus Nystrom <[email-masked]>
Date: Sat, 10 Jun 2000 10:51:09 +0200 (MET DST)

Paul,

On Fri, 9 Jun 2000, Paul Leach wrote:
> > be made more explicit in the draft.
> 

How about:
A client uncapable of verifying certificates? A situation where unilateral
authentication is enough?  A client uncapable of performing a full TLS
handshake?

BR,
-- Magnus

---

From: [email-masked] (John Myers)
Date: Sat, 10 Jun 2000 13:54:03 -0700

Magnus Nystrom wrote:
> authentication is enough?

A client can perform a TLS handshake and ignore the cert sent by the
server.  Like the proposed mechanism, such a client would be subject to
active attacks.  Unlike your proposed mechanism, such a client would be
protected from passive eavesdropping and would interoperate with the
installed base.

Our implmentation of STARTTLS in outgoing SMTP relay uses this mode. 
Subsequent releases will allow the site to configure which domains
require protection against active attack in outgoing SMTP relay.

> A client uncapable of performing a full TLS handshake?

Why would a client capable of managing a client cert and signing
authentication requests be uncapable of performing a full TLS handshake?

---

From: Magnus Nystrom <[email-masked]>
Date: Sat, 10 Jun 2000 10:51:09 +0200 (MET DST)

Paul,

How about:

BR,
-- Magnus

---

From: [email-masked] (John Myers)
Date: Sat, 10 Jun 2000 13:54:03 -0700