Subject: Re: IPP> Security proposal

From: [email-masked] (Bob Van Andel)
Date: Sat, 8 Nov 1997 16:41:14 -0500 (EST)

Randy,

>
> I'm wondering if we could define an *anonymous*
> authentication that clients could use and that IPP
> servers would recognize as a kind of *guest*
> authentication...this may have already been
> defined within some other security working group....
>

Why is *anonymous* printing (which is certainly a desirable case)
any different than *anonymous* Web site access?
In other words, why isn't unsecured access acceptable for this case?

Bob

Bob Van Andel
Allegro Software Development Corporation
43 Waite Road
Boxborough, MA  01719
(978) 266-1375
(978) 266-2839 fax

Read about the RomPager embedded web server toolkit at:
www.allegrosoft.com

---

From: Randy Turner <[email-masked]>
Date: Sun, 09 Nov 1997 19:23:38 -0800

> In other words, why isn't unsecured access acceptable for this case?

Logically, I think the two scenarios are the same. The problem with
this scenario is that HTTP and IPP have two different goals with
respect to the end user. Currently, I don't know of any way an HTTP
client has to direct an HTTP server to make a particular connection
secure, and IPP needs either end to indicate this requirement.

We're just using HTTP to transport IPP messages, IPP has different
end user scenarios...

Randy

---

From: "Scott Lawrence" <[email-masked]>
Date: Mon, 10 Nov 1997 09:48:56 -0500

>>>>> "RT" == Randy Turner <[email-masked]> writes:

RT> Currently, I don't know of any way an HTTP client has to direct an
RT> HTTP server to make a particular connection secure, and IPP needs
RT> either end to indicate this requirement.

  If you're using 'secure' as 'confidential', then the client requests
  that protection by making the connection on the SSL port (https:),
  and indicates that it does not require confidentiality by making the
  request on a non-SSL port.

  The service (the printer or print server) probably cares more about
  authentication than confidentiality for IPP, and it can get that on
  a connection that is either confidentiality protected or not using
  Digest Access Authentication.

--
Scott Lawrence           EmWeb Embedded Server       <[email-masked]>
Agranat Systems, Inc.        Engineering            http://www.agranat.com/