Subject: RE: I-D ACTION:draft-hansen-sasl-pki-00.txt

From: "Ramsay, Ron" <[email-masked]>
Date: Mon, 3 Mar 2003 12:32:49 +1100

Well, Kurt, you're the only one who has tried to make the TLS session transient. I go with the author who said it should last for the whole session. You don't put up an Aunt Sally just to knock it down again!

Ron.

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Monday, 3 March 2003 12:17
To: Ramsay, Ron
Cc: Lawrence Greenfield; [email-masked]; [email-masked]
Subject: RE: I-D ACTION:draft-hansen-sasl-pki-00.txt

At 05:03 PM 3/2/2003, Ramsay, Ron wrote:
>I don't see how this can work. You are proposing to use TLS while authentication is in progress and then drop back to cleartext. However, for LDAPv3, RFC 2830 Section 5.2 states that, after TLS closure, the authentication state should return to anonymous.

Good catch.  I then say that the I-D should note that one
of the reasons why TLS+SASL/PLAIN+closure is that application
profiles of TLS define inconsistent TLS closure semantics.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Mar 2003 18:09:10 -0800

At 05:32 PM 3/2/2003, Ramsay, Ron wrote:
>Well, Kurt, you're the only one who has tried to make the TLS session transient.

As I noted in my last response, it is now clear to me is that
TLS+SASL/PLAIN+closure is not a viable approach.

However, I content that it is not obviously so.  TLS is transient
by design.  And application protocol profiles of TLS could be
defined which support this approach.  And existing TLS and SASL
libraries would allow implementation of the approach.  And there
existing implementations of application protocols which do use
this approach today.

So, I think, my original question was quite reasonable to ask.
Personally, I think the answer deserves brief mention in the I-D.

Kurt

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 02 Mar 2003 18:09:10 -0800

Kurt