Subject: HTTP over SASL

From: Keith Burdis <[email-masked]>
Date: Sun, 25 Feb 2001 21:51:50 +0200

Hi there

Magnus Nystrom and Robert Zuccherato have submitted a proposal for using 
SASL with HTTP (draft-nystrom-http-sasl-00).

I have an alternative proposal based on RFC 2817 "Upgrading to TLS Within
HTTP/1.1".

RFC 2817 describes a means of using TLS with HTTP by upgrading to TLS from
within HTTP.  The advantage of this is that a separate port is not required
for a secure connection.  Once the upgrade is initiated the TLS protocol
starts.  If TLS authentication is successful, a secure connection is
established and subsequent HTTP messages are tunnelled through this
connection.
	        
The same procedure can be used with SASL.  An HTTP client and server
negotiate an upgrade to an SASL mechanism.  Once the upgrade is initiated,
the SASL mechanism protocol starts.  If the authentication procedure using
this mechanism is successful, subsequent HTTP messages are tunnelled through
this SASL connection.  If a security layer was negotiated as part of the
SASL mechanism exchange then it is used to protect any messages passing
through the connection, otherwise the messages are passed through unchanged.

The benefit of tunnelling HTTP through an SASL connection, rather than
making the SASL exchange part of HTTP, is that the TCP connection is
protected.  This means that the entire HTTP message is protected when
transmitted along this connection rather than just the HTTP body. Also, as
with TLS, once the upgrade has taken place, the HTTP protocol exchanges
continue unaware that they are being protected.

A copy of the full proposal is available at:

  http://www.cryptix.org/~keith/http-sasl/draft-burdis-http-sasl-00.html
  http://www.cryptix.org/~keith/http-sasl/draft-burdis-http-sasl-00.txt

Any comments are welcome.

Thanks.

  - Keith
--
Keith Burdis - MSc (Computer Science) - Rhodes University, South Africa
IRC: Panthras					JAPH 	QEFH
---