Subject: RE: [Simple] Impending WGLC: msrp relays

From: "Michael Hammer \(mhammer\)" <[email-masked]>
Date: Wed, 16 Mar 2005 14:45:58 -0500

Wasn't Basic Authentication deprecated?
 
Mike

________________________________

	From: [email-masked] [mailto:[email-masked]]
On Behalf Of Avshalom Houri
	Sent: Wednesday, March 16, 2005 11:00 AM
	To: Orit Levin
	Cc: Simple WG
	Subject: RE: [Simple] Impending WGLC: msrp relays

	Actually Orit may be raising an issue that we have not thought
about. 
	Basic authentication enables the relay administrator to see the
passwords of 
	the users. This is not acceptable by many organizations. 
	
	Can we say that the relay will accept digest authentication also
or enable 
	an extensibility mechanism? 
	Adding digest authentication may be easier to do but it may not
be acceptable 
	to organizations like 3GPP that use different authentication
method for SIP. 
	
	Avshalom 
	
	[email-masked] wrote on 10/03/2005 01:06:50 AM:
	
	> Guys,
	> 
	> One of the open issues mentioned during the meeting was
addressing the
	> MSRP Relay extensibility mechanism.
	> 
	> With the latest simplification of the authentication to be
limited to
	> Basic only, it becomes a major topic that needs to be nailed
down before
	> the spec closure. (Although the Basic over encrypted
hop-by-hop links
	> may be OK for some deployments - it will not be acceptable for
others.)
	> 
	> It is absolutely necessarily to define a mechanism that will
allow for
	> signaling alternative authentication methods (potentially
among other
	> features). Without it, I don't think MSRP can be deployed and
remain
	> interoperable.
	> 
	> Orit.
	> 
	> > -----Original Message-----
	> > From: [email-masked]
[mailto:[email-masked]] On
	> Behalf
	> > Of Robert Sparks
	> > Sent: Wednesday, March 09, 2005 7:29 AM
	> > To: Simple WG
	> > Subject: [Simple] Impending WGLC: msrp relays
	> > 
	> > The relay draft will undergo some minor changes as discussed
in
	> > the SIMPLE meetings this week in Minneapolis. The changes
are
	> > mostly simple editorial changes. One major change will be
the
	> > removal of the appendix describing stateless relay behavior.
	> > 
	> > This revision will be posted after the I-D blackout. When it
appears,
	> > it will be WGLCed. Please feel free to send comments against
	> > the current draft (minus the appendix mentioned above) this
week
	> > if you have time to provide them.
	> > 
	> > RjS
	> > 
	> > 
	> > _______________________________________________
	> > Simple mailing list
	> > [email-masked]
	> > https://www1.ietf.org/mailman/listinfo/simple
	> 
	> _______________________________________________
	> Simple mailing list
	> [email-masked]
	> https://www1.ietf.org/mailman/listinfo/simple

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Miguel Garcia <[email-masked]>
Date: Sun, 20 Mar 2005 11:32:49 +0200

In SIP Basic HTTP authentication was deprecated when RFC 3261 came out. 
MSRP initially used also HTTP Digest authentication, but during the 
meeting in Minneapolis it was mentioned that there is no need to use 
Digest, since the endpoint-to-MSRP relay interface is already protected 
by TLS.

/Miguel

Michael Hammer (mhammer) wrote:

>     ------------------------------------------------------------------------
>     From: [email-masked] [mailto:[email-masked]] On
>     Behalf Of Avshalom Houri
>     Actually Orit may be raising an issue that we have not thought about.
>     Can we say that the relay will accept digest authentication also or
>     enable
>     Adding digest authentication may be easier to do but it may not be
>     acceptable
>     to organizations like 3GPP that use different authentication method
>     for SIP.
> 
>     Avshalom
> 
>      > With the latest simplification of the authentication to be limited to
>      > Basic only, it becomes a major topic that needs to be nailed down
>     before
>      > the spec closure. (Although the Basic over encrypted hop-by-hop links
>      > signaling alternative authentication methods (potentially among other
>      > features). Without it, I don't think MSRP can be deployed and remain
>      > interoperable.
>      >
>      > Orit.
>      >
>      > > From: [email-masked] [mailto:[email-masked]] On
>      > Behalf
>      > > Of Robert Sparks
>      > > The relay draft will undergo some minor changes as discussed in
>      > > the SIMPLE meetings this week in Minneapolis. The changes are
>      > > mostly simple editorial changes. One major change will be the
>      > > the current draft (minus the appendix mentioned above) this week
> ------------------------------------------------------------------------
> 

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland