Subject: RE: PROPOSAL: Minimum Authentication and transport level encrypti on for CAP

From: Paul Leach <[email-masked]>
Date: Thu, 13 May 1999 10:12:12 -0700

> -----Original Message-----
> From: John Stracke [mailto:[email-masked]]
> Sent: Wednesday, May 12, 1999 8:18 PM
> 
> Paul Leach wrote:
> 
> > It's mandatory to implement, not mandatory to deploy,
> 
> I don't catch the distinction.  A piece of software that is speaking a
> protocol either meets all the MUSTs or it doesn't comply with the
> protocol.  Whether that noncompliance is because the vendor 
> didn't ship a
> feature or because one was disabled is not relevant to 
> interoperability.
> 
> (I don't mean to be argumentative; I suspect there's a useful 
> distinction
> here that I just haven't encountered before.)

The model above doesn't take into account options. Suppose the spec says
"MUST support feature A or feature B or feature C", and provides a way to
negotiate which one to use on any given client-server connection.

When there are such options in a protocol, all you have to do to be
compliant is implement one of each set of options. That implementation will
interop with any other implementation that handles the same set of options.

In order to guarantee that all implementations are capable of interop, at
least one choice for all options is made "mandatory to implement". Within a
given installation, though, it's perfectly OK to congigure a different
choice of options -- i.e., it's not mandatory to deploy.

Paul

---

From: John Stracke <[email-masked]>
Date: Thu, 13 May 1999 17:26:31 +0000

> choice of options -- i.e., it's not mandatory to deploy.

OK, got it.  I was taking "implementation" at a finer granularity (the actual
running code, not the vendor's distribution).  This makes sense, though.

--
/=============================================================\
|John Stracke    | My opinions are my own | S/MIME & HTML OK  |
[email-masked]|============================================|
|Chief Scientist | NT's lack of reliability is only surpassed |
|eCal Corp.      |  by its lack of scalability. -- John Kirch |
\=============================================================/