Re: URLs and TLS

Hi,

I cannot see that putting TLS= or MINCHIPHER= in the URL solves anything as
these have to be regarded as 'hints', not as 'orders'. The URL can indicate
to the browser that security should / must be used, but it will always be up
to the server serving the URL to accept or not accept the access to the URL.

It should always be possible to access (type into the browser) the URL
without any security info and from the server get access IF a secure
connection can be established, or IF the server decides to let anonymous
users to enter.

Frode Hernes
TelePost

-----Original Message-----
From: Mike Macgirvin <[email protected]>
To: Chris Newman <[email protected]>
Cc: Application Use of TLS IETF List <[email protected]>;
[email protected] <[email protected]>
Date: Tuesday, March 10, 1998 9:11 AM
Subject: Re: URLs and TLS


>> Here's an initial strawman to shoot at:
>>
>> If a URL includes a ";TLS=" parameter after the user name, that means TLS
>> support is required to resolve that URL.  My initial proposal for values
>> of this parameter is as follows:
>>
>> anon       Anonymous encryption must be used to prevent passive attacks
(?)
>> integrity  Server-side authentication and integrity protection must be
used
>> privacy    Server-side authentication and encryption must be used
>> auth       Server and client certs must be used to mutually authenticate
>>            via TLS (takes precedence over any ";AUTH=" parameter) and
>>            integrity protect the session.
>> full       Same as "auth", except encryption must also be used.
>>
>> Resolution of the URL fails if the security requirements in the URL
>> can't be met.  The client is free to use a higher level of TLS facilities
>> than the URL specifies.
>
>This may not be quite sufficient to adequately specify the desired policy.
>Perhaps an additional minimum cipher length would be useful.
>
> ;MINCIPHER=
>
> with the most commonly used values being: 128, 40 and 0.
>
>0 (or unspecified) means whatever can be agreed on, and doesn't guarantee
>that any encryption will occur. No doubt this will raise calls to include
>the entire cipher list; which may be the only way to completely specify the
>connection, but I'll toss it out as a counter strawman anyway. I'd hate to
>saddle the URL with something like
>
>TLSCIPHERS=+rsa_rc4_128_md5,+rsa_3des_sha,+rsa_des_sha,+rsa_rc4_40_md5,+rsa
_rc2_40_md5