Subject: Re: anyone else on this list?

From: "Jack De Winter" <[email-masked]>
Date: Wed, 19 Mar 1997 21:01:30 -0500

Sent this to Paul personally, instead of Paul and the list...

regards,
Jack

>>From [email-masked] Wed Mar 19 20:14:31 1997
>Date: Wed, 19 Mar 1997 17:25:27 -0800
>To: "Jack De Winter" <[email-masked]>
>From: "Paul E. Hoffman" <[email-masked]>
>Subject: Re: anyone else on this list?
>
>Jack, I noticed that you sent this to me personally. Given that someone
>from Netscape just said pretty much the opposite as you, I think you should
>send this to the list as well.
>
>--Paul Hoffman
>
>>At 03:22 PM 3/19/97 -0800, you wrote:
>>>At 8:41 PM -0800 3/18/97, Jack De Winter wrote:
>>>>how many people are on this list?
>>>
>>>Believe it or not, 46. *Someone* out there must have an opinion about SSL
>>>under SASL...
>>
>>okay... my opinion is that ANY authentication/encryption thing should be
>>done under SASL.  SASL is a great portable framework for adapting a whole
>>slew of interfaces to one interfacing method.
>>
>>That being said, is there anything in the specs for SSL that would forbid
>>it to be "switched on" when negotiated, as opposed to from the beginning of
>>the session?  Would this be against what it is set up for with HTTP?  Does
>>it need anything outside of the given protocol implementing SASL to function
>>properly?
>>
>>regards,
>>Jack
>>-------------------------------------------------
>>Jack De Winter - Wildbear Consulting, Inc.
>>(519) 576-3873		http://www.wildbear.on.ca/
>>
>>Author of SLMail for 95 & NT (http://www.seattlelab.com/)
>
>
>
>
>
>
-------------------------------------------------
Jack De Winter - Wildbear Consulting, Inc.
(519) 576-3873		http://www.wildbear.on.ca/

Author of SLMail for 95 & NT (http://www.seattlelab.com/)

---

From: Chris Newman <[email-masked]>
Date: Thu, 20 Mar 1997 09:27:15 -0800 (PST)

SSL has a number of other problems.  I doubt it permits both
authentication and authorization as the SASL kerberos mechanism does.
Specificly, it's useful to have an authentication credential that's
capable of authorizing access to multiple accounts.  This is especially
important for proxy operations.

In addition, SSL is primarily used in an RSA framework.  This requires
patent blood money, and thanks to RSA's rather annoying licensing rules
it's nearly impossible to get a "site license" for RSA.  By the IETF's
rules, that would tend to rule out standardization of any RSA-only
mechanism.

SSL is currently a session/presentation level mechanism, while SASL is an
application level mechanism.  Trying to fit these two different paradigms
together isn't easy, either.

It's probably worth trying to fit SSL under SASL to get the nice
authentication/encryption plug-in model that SASL provides and to avoid
SSL's excessive use of reserved ports in the case of IMAP, POP and SMTP.
It's probably a toss up whether to try to shoehorn SSL's session layer on
top of SASL's or to make an exception to SASL and replace its session
layer with SSL's session layer.  Pick one and see how it implements.

---

From: Chris Newman <[email-masked]>
Date: Thu, 20 Mar 1997 09:27:15 -0800 (PST)