Subject: Re: I-D Action: draft-zuccherato-9798-3-sasl-00.txt

From: [email-masked] (John Myers)
Date: Tue, 06 Jun 2000 17:03:23 -0700

I second Chris Newman's comments, though I think that if this is
intended for standardization then waiting for September 20 is better
than switching to DSA.

I'd appreciate it if you could expand on why you want to do this as a
SASL mechanism instead of using a combination of TLS and the EXTERNAL
SASL mechanism.  My experience with implementing this stuff is that the
key and certificate management aspects are far harder to implement than
the protocol aspects.

Each of the important protocols has an extension to start a TLS
negotiation on a previously unprotected connection.  At the latest
MailConnect, there were quite a few implementations of these STARTTLS
extensions.  Only three of these companies supported client certs, this
was up from one company the previous year.

A product implementing only this draft will not interoperate with a
product implementing only the combination of TLS and EXTERNAL.  TLS does
appear to have won the X.509 space and is gaining implementation
momentum.  I think this draft is approaching the wrong problem.

---

From: [email-masked] (John Myers)
Date: Tue, 06 Jun 2000 17:03:23 -0700