Subject: SSL under SASL

From: "Paul E. Hoffman" <[email-masked]>
Date: Tue, 18 Mar 1997 17:52:51 -0800

Hi, again. I'm going to be writing drafts on how to do SMTP, IMAP, and POP
over SSL. I sent the following message to the ietf-tls list earlier this
week:

=========================
Greetings. I'm going to be writing drafts on how to run the three primary
email protocols (SMTP, IMAP, and POP) over TLS. There is already an active
draft out for these three protocols that acts as a "front end" to
authentication and security protocols. This over-protocol, SASL, doesn't
yet have a mechanism for TLS built into it: it now covers Kerberos 4,
GSSAPI, and S/Key.

In talking to the SASL author about this, he has no strong feeling whether
I should add TLS to SASL or just come up with a set of non-SASL proposals
for SMTP/IMAP/POP over TLS. I'd like some TLS-savvy folks to take a look at
the SASL draft and discuss the merits of calling TLS from SASL on the SASL
mailing list. I don't think it is necessary to Cc this list on the
discussion; I'll summarize the results later.

To find the current SASL drafts and info on how to subscribe to the SASL
mailing list, please see <http://www.imc.org/ietf-sasl/>.

Thanks in advance.
=========================

Unfortunately, only two people signed up to this (ief-sasl) list in
response to this. I'd like to hear people's thoughts here before I decide
whether to use SASL as the mechanism for SSL or whether to do an orthogonal
approach.

My biggest concern is the last paragraph of section 3. Part of it says
"Each buffer is transferred over the connection as a stream of octets
prepended with a four octet field in network byte order that represents the
length of the following buffer." If I'm not mistaken, this means that if
someone has implemented SSL, they must *also* add this count to each
buffer. That would make it very difficult for people to use out-of-the-box
SSL kits.

Comments?

--Paul E. Hoffman, Director
--Internet Mail Consortium

---

From: "Paul E. Hoffman" <[email-masked]>
Date: Tue, 18 Mar 1997 17:52:51 -0800

Thanks in advance.

Comments?