Subject: Re: CAP: Security Considerations

From: "John Stracke" <[email-masked]>
Date: Wed, 13 Feb 2002 16:19:45 -0500

>- Do we want to specify a minimal encryption for CAP?

Probably--otherwise, we wind up with clients that can't talk TLS to 
servers from other vendors.

>- Is DIGEST-MD5 the authentication mechanism we want to
>  include?

I'd think so.  It's simple, and it doesn't send the password over the 
network.

/==========================================================\
|John Stracke                    |Principal Engineer       |
[email-masked]   |Incentive Systems, Inc.  |
|http://www.incentivesystems.com |My opinions are my own.  |
|==========================================================|
|"Where's your sense of adventure?" "Hiding under the bed."|
\==========================================================/

---

From: "John Stracke" <[email-masked]>
Date: Thu, 14 Feb 2002 12:11:07 -0500

>> >>>I do agree that we MUST mandate at least ONE minimum authentication
>> >>>level that CS/BEEP MUST support.  This was dictated to us by
>> >>>the area directors years ago
>> >>>
>> Why?
>> 
>  I can't say, I wasn't there.

It's basic IETF policy.  Without that, you don't get interoperability.

/========================================================\
|John Stracke                    |Principal Engineer     |
[email-masked]   |Incentive Systems, Inc.|
|http://www.incentivesystems.com |My opinions are my own.|
|========================================================|
|"What a plan! Simple, yet insane!" -- _Monsters, Inc._  |
\========================================================/

---

From: "John Stracke" <[email-masked]>
Date: Thu, 14 Feb 2002 12:11:51 -0500

>I was thinking of my wife's calendar and mine. I'm secure with who she 
>is and that her calendar and mine should talk.

Really? And are you willing to allow anybody who cracks into your client 
to talk to your CS without authenticating?

---

From: [email-masked]
Date: Tue, 19 Feb 2002 15:06:51 -0500

> I'd think so.  It's simple, and it doesn't send the password over the 

I concur w/John.  I havent checked recently but Id hope we do it along the 
lines of APOP where the CS provides a changing seed per authentication so 
a replay attack cannot be used to bypass authentication...

Bruce
===========================================================================
Bruce Kahn                                INet: 
[email-masked]
Messaging & Collaboration                 Phone: 978.399.6496
IBM Software Group                         FAX: and nothing but the FAX...
Standard disclaimers apply, even where prohibited by law...