Subject: RE: I-D ACTION:draft-hansen-sasl-pki-00.txt

From: "Ramsay, Ron" <[email-masked]>
Date: Mon, 3 Mar 2003 12:03:53 +1100

Hi Kurt,

I don't see how this can work. You are proposing to use TLS while authentication is in progress and then drop back to cleartext. However, for LDAPv3, RFC 2830 Section 5.2 states that, after TLS closure, the authentication state should return to anonymous.

Ron.

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Saturday, 1 March 2003 06:22
To: Lawrence Greenfield
Cc: [email-masked]; [email-masked]
Subject: Re: I-D ACTION:draft-hansen-sasl-pki-00.txt

At 11:02 AM 2/28/2003, Lawrence Greenfield wrote:
>   Date: Fri, 28 Feb 2003 10:06:54 -0800
>   From: "Kurt D. Zeilenga" <[email-masked]>
>
>   What's the advantage of this approach over using TLS+SASL/PLAIN
>   and then just closing TLS gracefully so that remainder of the
>   session is in the clear?
>
>You don't close TLS; you can renegotiate to the NULL cipher.

Application-level protocols may permit use the stream after TLS
closure.  See RFC 2246, Section 7.2.1.  LDAPv3 is an example,
RFC 2830, of an application-level protocol which explicitly
permits such use.

Kurt

---

From: "Ramsay, Ron" <[email-masked]>
Date: Mon, 3 Mar 2003 12:32:49 +1100

Well, Kurt, you're the only one who has tried to make the TLS session transient. I go with the author who said it should last for the whole session. You don't put up an Aunt Sally just to knock it down again!

Ron.

-----Original Message-----
From: Kurt D. Zeilenga [mailto:[email-masked]]
Sent: Monday, 3 March 2003 12:17
To: Ramsay, Ron
Cc: Lawrence Greenfield; [email-masked]; [email-masked]
Subject: RE: I-D ACTION:draft-hansen-sasl-pki-00.txt

>I don't see how this can work. You are proposing to use TLS while authentication is in progress and then drop back to cleartext. However, for LDAPv3, RFC 2830 Section 5.2 states that, after TLS clos…

Good catch.  I then say that the I-D should note that one
of the reasons why TLS+SASL/PLAIN+closure is that application
profiles of TLS define inconsistent TLS closure semantics.

Kurt