Subject: IPP> TLS security section of protocol document

From: "Turner, Randy" <[email-masked]>
Date: Mon, 2 Feb 1998 18:03:54 -0800

Just a note from the WG meeting in Hawaii...

During the discussions of security related matters regarding using
multiple
HTTP methods at the last meeting, Josh brought up a point that proxies
should be no problem with using a new method (such as PRINT) because it
would just transparently pass it on through. I'm assuming that proxies
do this with all methods the proxy does not recognize (unless some type
of method filtering is turned on).

This discussion got me thinking about proxies and IPP in general, with
my initial conclusion being that we have a problem using TLS for
end-to-end security in the presence of proxies. There is currently no
standard for delegation of authentication info across proxies ( or any
kind of "firewall" type of software). If the IPP client is configured to
work with a particular proxy, and the IPP client is attempting
communication with a TLS-based printer URI, we might need to indicate in
the protocol document that this (and possibly other scenarios) can
happen and what the implications of these scenarios might be.

My immediate question is do we consider updating the security
considerations section of the protocol document prior to IETF last call?

Randy

---

From: Carl Kugler <[email-masked]>
Date: Tue, 3 Feb 1998 11:55:39 -0500

Is the approach in

  Network Working Group                                      Ari Luotonen
  Request for Comments: XXXX          Netscape Communications Corporation
  Category: Informational                                 September, 1997

                Tunneling SSL through Web Proxy Servers

 draft-luotonen-ssl-tunneling-03.txt, expires on 9/26/97

being considered for TLS?

  -Carl

[email-masked] on 02/02/98 02:25:38 PM
Please respond to [email-masked] @ internet
To: [email-masked] @ internet
cc:
Subject: IPP> TLS security section of protocol document

Randy

---

From: "Turner, Randy" <[email-masked]>
Date: Tue, 3 Feb 1998 10:03:11 -0800

This and other work being considered for credential delegation would be
potential solutions but nothing is standards-track (yet), and it is
unclear whether anything is being considered for any kind of near-term
deployment. If anyone has any other info, please post the DL.

I haven't seen any activity on the ietf-tls-apps mailing list either. I
just thought a paragraph describing the current situation might be
needed in the protocol document, possibly before submission to the IESG
for publication as an RFC.

Randy

	-----Original Message-----
	From:	Carl Kugler [SMTP:[email-masked]]
	Sent:	Tuesday, February 03, 1998 8:56 AM
	To:	[email-masked]
	Subject:	Re: IPP> TLS security section of protocol
document

	Is the approach in

	  Network Working Group                                      Ari
Luotonen
	  Request for Comments: XXXX          Netscape Communications
Corporation
	  Category: Informational
September, 1997

	  -Carl

	During the discussions of security related matters regarding
using
	multiple
	HTTP methods at the last meeting, Josh brought up a point that
proxies
	should be no problem with using a new method (such as PRINT)
because it
	would just transparently pass it on through. I'm assuming that
proxies
	do this with all methods the proxy does not recognize (unless
some type
	of method filtering is turned on).

	This discussion got me thinking about proxies and IPP in
general, with
	my initial conclusion being that we have a problem using TLS for
	end-to-end security in the presence of proxies. There is
currently no
	standard for delegation of authentication info across proxies (
or any
	kind of "firewall" type of software). If the IPP client is
configured to
	work with a particular proxy, and the IPP client is attempting
	communication with a TLS-based printer URI, we might need to
indicate in
	the protocol document that this (and possibly other scenarios)
can
	happen and what the implications of these scenarios might be.

	My immediate question is do we consider updating the security
	considerations section of the protocol document prior to IETF
last call?

	Randy

---

From: Carl-Uno Manros <[email-masked]>
Date: Tue, 3 Feb 1998 09:37:04 PST

>considerations section of the protocol document prior to IETF last call?

Randy,

I think that anything to do with proxy servers and firewalls can only
reliably be found out by real life testing, which is what Proposed
Standards are for. I do not see any points in doing further updates to the
our specification at this stage.

Carl-Uno 
Carl-Uno Manros
Principal Engineer - Advanced Printing Standards - Xerox Corporation
701 S. Aviation Blvd., El Segundo, CA, M/S: ESAE-231
Phone +1-310-333 8273, Fax +1-310-333 5514
Email: [email-masked]