New version of TLS + IMAP/POP/ACAP draft

Chris Newman <[email protected]> Thu, 19 Nov 1998 10:31:19 -0800 (PST)
Newsgroups gmane.ietf.apps-tls
Message-ID <[email protected]>
I did one more version of the TLS + IMAP/POP/ACAP draft:

  <ftp://ftp.ietf.org/internet-drafts/draft-newman-tls-imappop-05.txt>

I will ask for an IETF last call in one week if I receive no change
suggestions.  If I get change suggestions, I will ask for a last call
immediately after the next draft is released unless they're major.

Changes from the last draft:

I've done a fair amount of re-wording to try to make things clearer.

Since I believe the primary use of TLS for these protocols will be in
combination with clear-text passwords, I've added a "clear-text password
requirement".  This requires a server that implements both STARTTLS and a
clear-text mechanism (including IMAP LOGIN, POP3 PASS, and PLAIN) to
have an operational mode where all clear-text login commands and
mechanisms are disabled unless TLS encryption is active.  I'm not
presently aware of a server that implements SSL/TLS and fails to meet this
requirement so I don't think it's an unreasonable burden.

I added text about the server identity check.  This is largely ripped off
from the LDAP + TLS spec although I re-worded it a bit.

I loosened up the syntax for the PLAIN SASL mechanism a bit to allow any
non-zero octet in the password.

The IANA considerations section is fleshed out, including registrations
for the IMAP, POP and ACAP extensions.

		- Chris