Re: New version of SMTP/TLS

> -----Original Message-----
> From: Paul Hoffman / IMC <[email protected]>
> To:
> Date: Tuesday, November 04, 1997 11:22 AM
> Subject: New version of SMTP/TLS
> 
> 
> >If we're all happy with the draft, I'd like to send it in for IETF last
> >call next week. Please speak up if you have any issues with this.
> 
> 
> Paul,
> 
> The sooner this goes to last call the better, as far as I'm concerned.  A
> few points I noticed in the latest draft, though:
> 
> In section (5) on the STARTTLS command, in the paragraph after the error
> codes, it says "After receiving a  220 response to a STARTTLS command, the
> client SHOULD issue a STARTTLS command before giving any other SMTP
> commands."  That looks unworkably circular to me - am I missing something?
> Why the change from "After receiving a 220 response to a STARTTLS command,
> the client MUST start the TLS procedure immediately."?
> 
> Also, at the end of section (7) you say that SMTP-AUTH doesn't allow for
> using TLS.  SASL _does_ allow for mechanisms such as TLS, though, through
> the EXTERNAL method.

Just to clarify...the EXTERNAL method in SASL appears useful when attempting to
authorize a connection using different credentials than were used during
authentication. Such distinctions might be important when coming through a
firewall.  Then again, maybe not ;-).

If distinguishing authorization credentials from authentication credentials is
deemed important, it should be addressed in this spec (perhaps referencing
SASL), IMO.

/msb

> 
> -- jeff
> 
> 
>