Subject: Re: IPP> Security proposal

From: Jay Martin <[email-masked]>
Date: Fri, 07 Nov 1997 18:13:13 -0500

Turner, Randy wrote:
> 
> I have placed a draft of my IPP security proposal on the
> PWG FTP server.
> 
> There is a Microsoft Word 2.0 document version
> 
> ftp://ftp.pwg.org/pub/pwg/ipp/drafts/ippsec.doc
> 
> and an HTML version
> 
> ftp://ftp.pwg.org/pub/pwg/ipp/drafts/ippsec.html

When I try to access the HTML form, I get a blank document.
Perhaps an upload error?

	...jay

---

From: Carl-Uno Manros <[email-masked]>
Date: Fri, 7 Nov 1997 16:46:05 PST

At 02:55 PM 11/7/97 PST, Turner, Randy wrote:
>Randy

Randy,

Randy,

Thanks for taking the time to put your ideas on paper.

I looked over your proposal and would like you to comment on the following
things.
I expect to get back with more detailed comments after having spoken to my
security guys on Monday.

1) I was disappointed that you did not spell out what is now the minimum
"extra stuff" that every implementation would have to include if we
mandated TLS negotiation for all IPP clients and servers. My latest
impression is that it is a lot more than we anticipated when the subject
was discussed in the Boulder PWG meeting.

2) Earlier today Keith Moore came up with a proposal to take a new look at
SASL, which might eliviate some of the extra burden that 1) above might
incur. Do you or anybody else knows if "the world" is really going to
implement SASL in the foreseeable future (or are we up against yet another
road block here)? Judging from the comments on the DL recently, a number of
people have asked for a very light weight mechanism to do the initial
security negotiation, with the option to say "NO I do not want any
security", and I am still not convinced that TLS will deliver that.

---

If I have interpreted the feelings of the WG on this subject correctly, I
would like to draw a comparison with safe sex:

If you tend to mix with new or potentially unreliable partners, you are
quite likely to want to have some form of protection and would welcome the
subject to be brought up before you get too intimate. However, if you only
practise it with a steady and wellknown partner, you would probably be
upset to have to go through a forced negotitation about different types of
preventive tools and methods every time. If you trust your partner, you
should be allowed to practise unsafe sex at your own risk, without any
lengthy negotiation beforehand!

Regards,

Carl-Uno
Carl-Uno Manros
Principal Engineer - Advanced Printing Standards - Xerox Corporation
701 S. Aviation Blvd., El Segundo, CA, M/S: ESAE-231
Phone +1-310-333 8273, Fax +1-310-333 5514
Email: [email-masked]

---

From: [email-masked] (Bob Van Andel)
Date: Sat, 8 Nov 1997 16:41:14 -0500 (EST)

Randy,

>
> I'm wondering if we could define an *anonymous*
> authentication that clients could use and that IPP
> servers would recognize as a kind of *guest*
> authentication...this may have already been
> defined within some other security working group....
>

Why is *anonymous* printing (which is certainly a desirable case)
any different than *anonymous* Web site access?
In other words, why isn't unsecured access acceptable for this case?

Bob

Bob Van Andel
Allegro Software Development Corporation
43 Waite Road
Boxborough, MA  01719
(978) 266-1375
(978) 266-2839 fax

Read about the RomPager embedded web server toolkit at:
www.allegrosoft.com