Subject: Re: [lemonade] Compression: TLS or Application-layer

From: Stephane Maes <[email-masked]>
Date: Fri, 1 Oct 2004 14:28:22 -0600

Sorry my laptop is down and I am on the road. It will take me a while to catch up and participate to these conversations.

I believe we should be able to provide the option to encrypt the content of the exchanged e-mail / notification with encryption (as we should be able to use compression).

This guarantees being able to provide the confidentiality and optimizations required even when you have a device that does not support TLS or you have firewall issues. Associated to it.

Why can't it be allowed when selected between client and server? I recommend that it be the case. P-IMAP showed a way to do it. If we have secure transport (e.g start TLS) we just have not to use any other compression. But I think it is key to provide that option. P-IMAP showed that it can be done rather simply.

I think we should allow that to take place.

Stephane
_____
Stephane H. Maes, PhD,
Director of Architecture - Mobile, Oracle Corporation.
Ph: +1-203-300-7786 (mobile/SMS); Fax / UM: +1-650-607-6296.
e-mail: [email-masked]
IM: shmaes (AIM, Y!) or [email-masked] (MSN Messenger) 

-----Original Message-----
From: [email-masked] <[email-masked]>
To: [email-masked] <[email-masked]>
Sent: Fri Oct 01 12:50:45 2004
Subject: Re: [lemonade] Compression: TLS or Application-layer

> If you insist on "NO TLS!" on wireless devices, then you're forcing
> your customers' email out into the open, where nasties like me can
> listen, and that's going to be painful for your customers. On the
> other hand, if you use TLS, then you can either use the null cipher
> for better battery lifetime, or you can use real crypto.

And don't the vast majority of these devices already support SSL (for 
https)? I am far from convinced that the incremental cost of adding TLS 
is a show stopper. And don't forget, STARTTLS is now mandatory to 
implement in IMAP, so the servers that don't currently support it will 
soon (or will die out due to market pressure).

I am very strongly opposed to adding compression to IMAP itself. TLS 
already provides the infrastructure.

--lyndon

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade

---

From: Lyndon Nerenberg <[email-masked]>
Date: Fri, 01 Oct 2004 22:17:08 -0700

--On 2004-10-1 2:28 PM -0600 Stephane Maes <[email-masked]> 
wrote:

> This guarantees being able to provide the confidentiality and
> optimizations required even when you have a device that does not
> support TLS

But as was mentioned earlier, IMAP (RFC3501) *requires* TLS, so what is 
the issue? If your "IMAP" device does not suppport TLS, it isn't an 
IMAP device.

--lyndon