Subject: Re: IPP> on the use of SSL3 framing and SASL

From: [email-masked] (Xavier Riley.)
Date: Fri, 7 Nov 1997 15:34:47 PST

Keith,

> 
> Also, while it's technically feasible to always use TLS framing with
> IPP, it seems like it would be far better to define a SASL negotiation
> framework for HTTP, which could then negotiate TLS.  SASL is already a
> Proposed Standard RFC, and is being retro-fitted into a number of
> existing apps protocols.
> 
> Keith
> 

Any estimate on how soon you expect the major Web server
vendors to implement SASL and TLS in their Web servers?

Thanks,
Xavier

 ______________________________________________________________________
 Xavier Riley                     
 Xerox Corp.                      
 Corp. Research & Tech.           Voice: 310-333-8329 / 8*823-8329   
 701 S. Aviation Blvd ESAE-231    Fax: 310-333-6618 / 8*823-6618
 El Segundo, California 90245     Email: [email-masked] 
 ______________________________________________________________________

---

From: Keith Moore <[email-masked]>
Date: Fri, 07 Nov 1997 19:49:20 -0500

> vendors to implement SASL and TLS in their Web servers?

No. I'll have to poll them to see what they think.
(but then again, how many of them implement TLS framing w/o security?)

One advantage in IPP using SASL+TLS over just TLS would be
that an IPP client or server that didn't need security
could use ordinary HTTP client or server code.  

Personally, I'm hoping that all of the protocols layered on
HTTP can use the same security negotiation mechanism.

Keith