Subject: CAP comment, section 4.6, Security

From: "Paul B. Hill" <[email-masked]>
Date: Tue, 08 Dec 1998 10:54:09 -0500

Hi,

4.6     Security

   CAP MUST specify:
...
     - How the CUA authenticates to CS using SASL.

It seems odd that the CAP Requirements document is specifying the use of
SASL. Shouldn't the Requirements document specify that a protocol that is
accepted within the IETF community be used for authentication and defer the
choice of the specific authentication protocol to the actual CAP protocol
document?

The transport protocol for CAP has not been chosen yet. If we ended up
choosing a connectionless protocol CAP, then SASL would be inappropriate.

Paul