Subject: Re: [lemonade] Re: I-D ACTION:draft-ietf-lemonade-compress-05.txt

From: Randall Gellens <[email-masked]>
Date: Wed, 10 Jan 2007 17:50:51 -0800

At 1:01 PM +0100 12/1/06, Arnt Gulbrandsen wrote:

>  On one hand, we have Ken, Martin and to some degree me, who would 
> like to make COMPRESS a command-auth. Martin put forward an 
> argument for that: command-auth makes it impossible to attack the 
> compression library unauthenticated. (For servers which also offer 
> to compress via TLS this doens't apply.) I like command-auth 
> because it avoids so much hair-splitting in the definition (as Dave 
> too says).
>
>  On the other hand, we have Dave and Ben, who like the text above.
>
>  What do other people think? Lurkers of the world, stand up and be heard!

[I'm not normally a lurker on this list, but I am behind and trying 
to catch up.]

Is there any benefit to allowing COMPRESS prior to authentication? 
IIRC, last time this was discussed, it was mentioned that compressing 
the authentication exchange provided a small bandwidth savings but 
made debugging harder.  Add to that the point that unauthenticated 
attacks on compression become possible, and I don't see any reason to 
allow COMPRESS while unauthenticated.
-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
  "American Non Sequitur Society --
   We don't make sense,
   But we do like pizza."

_______________________________________________
lemonade mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/lemonade