Subject: Ftp-WG: FTP, TLS and virtual hosting

From: [email-masked]
Date: Fri, 22 Sep 2000 03:57:20 -0500

Sounds like a good idea, but I guess I have the concern that this won't
actually solve the problem we have today.  With SSL so firmly established,
I have not seen any mass migration toward TLS and so I am not convinced
that adding an extension to an update to TLS will solve the problem in
anything but the long term.

For this reason - I still feel that the HOST command has some mileage.

Cheers,
Paul

--
Paul Ford-Hutchinson :  eCommerce application security :
[email-masked]
MPT-6, IBM , PO Box 31, Birmingham Rd, Warwick, CV34 5YR +44 (0)1926
462005
w3 - http://dandare.inedi.warwick.uk.ibm.com/~pfh/mine.html

Please respond to FTPEXT Working Group <[email-masked]>
To:     "FTPEXT Working Group" <[email-masked]>
cc:      (bcc: Paul V Ford-Hutchinson/UK/IBM)
Subject:        Ftp-WG: FTP, TLS and virtual hosting

Mark Symons <[email-masked]> wrote:
>I want to see HOST get properly defined because of its importance to
using
>the AUTH comand for securing FTP with TLS.

While I haven't read ftp-ssl-06, on the TLS working group we have what
looks
like a consensus on extending the TLS ClientHello to include extensions.
Included in that proposal is an extension for a client to provide a dns
name
in the client hello, with the specific purpose of allowing the server to
choose an appropriate certificate.

I haven't written up the final proposed changes to the next TLS RFC yet,
but
I will do that over the next week or so.

Jan Mikkelsen