re: New version of TLS + IMAP/POP/ACAP draft

On Wed, 25 Nov 1998, Chris Newman wrote:

: On Tue, 24 Nov 1998, Mark Crispin wrote:
: > On Tue, 24 Nov 1998 12:02:35 -0800 (PST), Chris Newman wrote:
: 
: Some thought should probably be put into STARTTLS-style support in an
: stunnel-like model.



: Netscape 4.5 uses STARTTLS for smtp, but the problems with the "smtps"
: port (now de-registered) are a bit more serious than those with respect to
: imaps/pop3s.

Heh, you are right... smtps is gone.

: > I'm not even sure that I understand the point of STARTTLS, unless it's just to
: > reduce the number of ports assigned.
: 
: The main point is that there are three useful modes for TLS:
: * Never use it
: * Always use it
: * Use it when available
: 
: The third mode is the correct default, IMHO, as it interoperates with the
: installed base, but gracefully upgrades security.  Furthermore, the third
: mode is the natural mode for STARTTLS.
: 
: There's also the issue with URL schemes.  If I have a server which
: supports TLS and non-TLS, but I'd prefer people use TLS, the
: "http"/"https" model doesn't allow that to be expressed.  In fact,
: real-world usage of "https" has intruded heavily into the user interface
: forcing users to make security decisions they shouldn't have to make.

The most common concern, or complaint as it were, that I get is the overhead
to do the encryption for large data. If one could dynamically turn TLS on or
off after authentiction was negotiated, I would agree with you that TLS
should be used when avaliable. 

However, if I have Kerberos-SASL avaliable to my on-site clients, and only
TLS guaranteed for the off-site clients, then I would want to default to
Kerberos-SASL first, then TLS. If there is the need for everything to be
encrypted, then TLS should be forced.

I am trying to suggest that there may not be a clear cut order, and that
local preferences will abound depending on the avaliable SASL or TLS
methods. I would expect a client to take the "CAPABILITY" of the server
and make a preference list based on that and what it's capabilities and
preferences are.

Randall