Subject: RE: [lemonade] Call the Question - Compression: TLS orApplication-layer

From: [email-masked]
Date: Tue, 5 Oct 2004 07:25:05 -0500

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On
> Behalf Of ext Stephane H. Maes
> Sent: Tuesday, October 05, 2004 3:26 AM
...
> 
> First, it is in our experience that corporate may not open 
> firewall port other than 80 and 443. This is a typical use 
> case of why IMAP over TLS (IMAPS, ...) does not solve all 

This is an orthogonal issue that should not have any bearing on this discussion. This could be a thread by itself, but I do not see how it argues for application level compression.

> the issues above, it should be possible to use "application 
> level encryption" and Application level compression" to 

profile-00 has nothing in it regarding application level encryption. Is there a newer version? So you would like application level encryption as well. I believe this is a very serious mistake. Once you go down this route you are now reinventing many security solutions that have already been solved and peer reviewed by the general community.

> 
> In addition, as a related topic, and in order to allow use 
> case / deployment model where a lemonade proxy is deployed in 
> a service provider / operator domain that differs from 
> corporate mail server, it is critical that application level 
> encryption of the payload be possible. Otherwise, we risk 
> similar security holes similar to the famous "WAP gap" that 

Could you explain in technical detail the problem here. I don't see it. Are you saying there will be a problem similar to WAP Gap or are you saying the WAP Gap will be a problem. The "WAP Gap" was solved by WAP 2.0.

Mike

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade