Subject: Re: TLS/SASL

From: "Jack De Winter" <[email-masked]>
Date: Thu, 20 Mar 1997 16:16:11 -0500

>I'm sure others can add to these.  The key point I want to get across
>to those with a SSL/TLS background is that TLS as a framework and as
>an existing implementation lacks some features/capabilities which are
>very important to the applications/mail community.  I don't have
>religious convictions on how these capabilities are provided, but I
>don't see current straight-SSL approaches moving towards providing
>those capabilities.

I guess from my viewpoint, I would prefer to see everything 'under
the auspices of SASL'... face it, having one interface that takes
care of the other authentications and encryptions is a lot easier to
code to and explain than having this command for this authentication
and that command for that encryption.

Where this breaks down is applicability.  I have heard some verifiable
comments from a couple of sources that worry about a SASL-SSL downgrading
to a SASL-<x> without warning the user.  While I think this is a client
and server problem (both should have restrictions to limit the concept
of a secure connection and should notify the user if possible), it is still
a problem.

regards,
Jack
-------------------------------------------------
Jack De Winter - Wildbear Consulting, Inc.
(519) 576-3873		http://www.wildbear.on.ca/

Author of SLMail for 95 & NT (http://www.seattlelab.com/)