Subject: RE: [Simple] Impending WGLC: msrp relays

From: "Orit Levin" <[email-masked]>
Date: Wed, 9 Mar 2005 15:06:50 -0800

Guys,

One of the open issues mentioned during the meeting was addressing the
MSRP Relay extensibility mechanism.

With the latest simplification of the authentication to be limited to
Basic only, it becomes a major topic that needs to be nailed down before
the spec closure. (Although the Basic over encrypted hop-by-hop links
may be OK for some deployments - it will not be acceptable for others.)

It is absolutely necessarily to define a mechanism that will allow for
signaling alternative authentication methods (potentially among other
features). Without it, I don't think MSRP can be deployed and remain
interoperable.

Orit.

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On
Behalf
> Of Robert Sparks
> Sent: Wednesday, March 09, 2005 7:29 AM
> To: Simple WG
> Subject: [Simple] Impending WGLC: msrp relays
> 
> The relay draft will undergo some minor changes as discussed in
> the SIMPLE meetings this week in Minneapolis. The changes are
> mostly simple editorial changes. One major change will be the
> removal of the appendix describing stateless relay behavior.
> 
> This revision will be posted after the I-D blackout. When it appears,
> it will be WGLCed. Please feel free to send comments against
> the current draft (minus the appendix mentioned above) this week
> if you have time to provide them.
> 
> RjS
> 
> 
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple

---

From: Hisham Khartabil <[email-masked]>
Date: Thu, 10 Mar 2005 00:22:16 +0100

> may be OK for some deployments - it will not be acceptable for others.)

Why not? What is your concern with this mechanism?

> features). Without it, I don't think MSRP can be deployed and remain

If you have a concern with this mechanism, then you need to bring in 
details now. You can't raise a concern that you yourself don't know or 
understand. If that concern truly exists, then we need to fix it now.

Hisham

---

From: Avshalom Houri <[email-masked]>
Date: Wed, 16 Mar 2005 18:00:23 +0200

Actually Orit may be raising an issue that we have not thought about.
Basic authentication enables the relay administrator to see the passwords 
of
the users. This is not acceptable by many organizations.

Can we say that the relay will accept digest authentication also or enable
an extensibility mechanism?
Adding digest authentication may be easier to do but it may not be 
acceptable
to organizations like 3GPP that use different authentication method for 
SIP.

Avshalom

---

From: Miguel Garcia <[email-masked]>
Date: Sun, 20 Mar 2005 11:26:00 +0200

Avshalom:

Isn't it so that, in any case, no matter whether you use Basic or Digest 
authentication, the administrator of the relay can always see the users' 
password? I can imagine that the administrator has the tools and control 
to enable eavesdropping of password at the relay. The basic assumption 
is that users trust the relay, the same way that users trust existing 
commertial e-mail or presence services for storing username/password 
combinations.

/Miguel

Avshalom Houri wrote:
> Basic authentication enables the relay administrator to see the 
> passwords of
> ------------------------------------------------------------------------
> 

-- 
Miguel A. Garcia           tel:+358-50-4804586
Nokia Research Center      Helsinki, Finland