Re: draft-newman-tls-imappop-02.txt

>This version includes changes to the Cipher Suite Requirements

...which I feel are not acceptable. The insertion of heavy-handed politics
into
this draft is inappropriate, given that no one on this list asked for them.

The first paragraph of section 2 is fine; the second and third paragraphs
should be removed.

In the second paragraph, you mandate user interface requirements, which I
think
is a first for you, Chris. :-) It does not belong in a standards-track
document. The third paragraph is just hyperbole, including a phrase in all
capital letters for developers who can't read phrases in mixed case.

The first paragraph clearly states the requirements, and that is good enough
for the protocol. Please remove the junk and put out another draft that we can
look at before you submit this to the IESG.

, to the
>discussion of the "imaps" and "pop3s" ports, adds STARTTLS for ACAP, and
>adds a PLAIN SASL mechanism for use with ACAP under TLS.

Another note. You have the following paragraph buried in the security section:

     An active attacker can always cause a down-negotiation to the
     weakest authentication mechanism or cipher suite available.  For
     this reason, implementations need to be configurable to refuse weak
     mechanisms or cipher suites.

There was a desire on this list to put that kind of wording in the normative
text portion of the SMTP/TLS draft. That would be harder for you, because
you'd
have to put it in three times, but you should still consider it. This is the
one aspect of foo/TLS that was of most interest to people on the TLS mailing
list, and was probably the most carefully scrutinized during the SMTP/TLS
discussion. Maybe you just got too worked up about the 40-bit stuff...


--Paul Hoffman, Director
--Internet Mail Consortium