Subject: RE: Some Text on Security

From: "Larry Osterman (Exchange)" <[email-masked]>
Date: Wed, 31 Mar 1999 12:18:55 -0800

Ok, I'll try sell it.  HTTP-DIGEST is a SASL-ized version of the HTTP DIGEST
authentication mechanism.  As such, any server/client software that has
support for HTTP authentication will already have logic in it that's
suitable for packaging up for HTTP-DIGEST.  It's my understanding that a
bunch of the IETF protocols are moving to DIGEST as their must-implement
authentication mechanism.  The only other competing mechanisms that I'm
aware of are:

	PLAIN (but only under TLS due to IESG no plaintext rules)
	CRAM-MD5 (plain text equivilant, but cannot requires a server-side
authentication database that is NOT interoperable with other server side
databases)
	GSS-SPNEGO - Requires that the client and server use GSSAPI.

Paul's the author, he can speak much more eloquently than I could about it.

-----Original Message-----
From: Doug Royer [mailto:[email-masked]]
Sent: Monday, March 29, 1999 6:46 PM
To: [email-masked]
Subject: RE: Some Text on Security

> From: "Larry Osterman (Exchange)" <[email-masked]>
> Date: Mon, 29 Mar 1999 18:29:38 -0800
> 
> I suspect that SASL is a MUST implement for the calendering protocols, the
> only issue is really what SASL mechanisms are mandated as manditory,

I agree 'I' think that SASL is a MUST.

>    and I'd
> guess that the HTTP-DIGEST authentication mechanism is the most likely
> choice for a must-implement mechanism.

Why? - as in "Sell it"

-Doug
-------------------------------------------------------------------
[email-masked]		http://playground.sun.com/~dougr
801 W. El Camino #131		Work:   (650)786-7599
Mountain View, CA 94040		Ham Radio: N6AAW, Aviation: PP-ASEL

---

From: Bob Mahoney <[email-masked]>
Date: Wed, 31 Mar 1999 22:30:25 -0500

>authentication mechanism.  The only other competing mechanisms that I'm

It might be useful for folks to review Keith and Patrik's draft, "On 
the use of HTTP as a Substrate for Other Protocols"  It's at:

http://www.ietf.cnri.reston.va.us/internet-drafts/draft-iesg-using-http-00.txt

A lot of really relevant information, in a nice format.  It discusses 
HTTP digest, TLS, Firewall transversal, and a lot of other 
terms/ideas we'll be tossing about.  :-)

-Bob