Subject: RE: [Simple] OPEN ISSUE: Basic vs. Digest authentication in MSRPrelays extension

From: "Orit Levin" <[email-masked]>
Date: Tue, 28 Jun 2005 12:33:54 -0700

I strongly support Avshalom's request for including in the specification
the ability to negotiate the security method to be used with a
particular Relay.

We can say that Basic is MUST to implement but we can not prescribe what
level of security is going to be used in real deployments. If we want
implementations from different vendors interoperate according to this
standard - cutting the edges for "simplicity" will lead to opposite
results.

I don't think that this list is the right place to have a serious
security debate but some facts are obvious: the credentials for Basic,
being sent in clear inside the hop-by-hop TLS connections, may be
different for different Relays and you don't want to expose them to
anyone who has an access to the relays in the middle. (And I hope that
IETF is not addressing monolithic systems only that will be OK with a
single method and a single password.)

Orit.

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Cullen Jennings
> Sent: Tuesday, June 28, 2005 7:43 AM
> To: Avshalom Houri; [email-masked]
> Cc: Aki Niemi
> Subject: Re: [Simple] OPEN ISSUE: Basic vs. Digest 
> authentication in MSRPrelays extension
> 
> On 6/27/05 7:17 AM, "Avshalom Houri" <[email-masked]> wrote:
> 
> > In order to go ahead can we come with a way to enable a 
> relay to offer 
> > basic or digest or other method in its 401 response? This 
> way servers 
> > can be configured to use different methods according to the 
> required 
> > security level and clients can reject too weak method if they want. 
> > This will also enable clients that do not have enough 
> memory/CPU and 
> > that work in a protected environment to use only basic 
> authentication.
> 
> Few trivial notes ...
> 
> I don't think there is a very good argument to be made that 
> there are devices that are capable of TLS but can't do 
> digest. (I know you are not making this argument but just 
> tossing in this comment)
> 
> Thought I can live with either basic/digest I would really 
> prefer one over both.
> 
> 
> 
> 
> _______________________________________________
> Simple mailing list
> [email-masked]
> https://www1.ietf.org/mailman/listinfo/simple
> 

_______________________________________________
Simple mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/simple