Re: TLS and ACAP/IMAP/POP

At 04:23 PM 4/20/98 -0700, Chris Newman wrote:
>(A) Do most or all current SSL/TLS API's support closing TLS without
>closing the underlying socket?  If they don't it adds significant extra
>complexity to require it. 

I've been told "yes".

>(B) Is it really useful to close TLS and continue the connection with no
>connection?

In the SMTP/TLS case, I'd say "yes", because there may be transactions you
are willing to do without authentication or privacy.

>  With LDAPv3 it is likely useful since writes are infrequent
>and reads of public information are frequent.  With IMAP/POP/ACAP I'm far
>from convinced since there is less public information and mixed read/write
>access is the norm.

Agree.

> Does 3DES by itself result in servers becoming
>CPU-bound rather than I/O bound?  Would it be useful to support use TLS in
>a mode where the security layer is only active during authentication to
>make it slightly easier to integrate into an app protocol? 

I have no idea.

>I'm inclined to remain silent on this issue until we're confident "yes" is
>the answer to these questions.  Does anyone strongly object to this
>position?

I don't object, but I think the "yes" answers above make it reasonable to
think about dealing with in the current drafts. I actively chose not to,
but YMMV.

--Paul Hoffman, Director
--Internet Mail Consortium