Subject: makeSocket and SASL/TLS (WG last call on the Java API)

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Mon, 12 Mar 2001 17:40:35 -0800

>4.38.1 makeSocket 
>   There may be additional makeSocket methods defined when interfaces to 
>   establish TLS and SASL authentication in the Java environment have 
>   been standardized. 

I'm not sure what to make of this paragraph.  Can someone
elaborate as to its meaning and implications upon the
specification and its implementors?

Kurt

---

From: Rob Weltman <[email-masked]>
Date: Mon, 12 Mar 2001 21:30:01 -0800

> specification and its implementors?

  That's actually been there since the first draft, four years ago. It's redundant/incorrect now that interfaces for SASL and TLS have been defined.

Rob

---

From: "Kurt D. Zeilenga" <[email-masked]>
Date: Sun, 25 Mar 2001 20:28:44 -0800

>4.6.30 isTLS
>
>   public boolean isTLS ()
>
>   Indicates if the connection uses TLS, i.e. startTLS has completed.

StartTLS can successful complete but TLS may not be establish.

Hence, a better description would be "Indicates the session
is currently protected by TLS."  I would note that as the
method provides no indication of the level of protection
provided (which could be nil or near nil), a security
consideration should be noted to warn users of inappropriate
use of the method.

---

From: Rob Weltman <[email-masked]>
Date: Mon, 26 Mar 2001 18:57:00 -0800

> consideration should be noted to warn users of inappropriate

OK