Re: returning to the previous state

Jim and all,

  First of all let me preface my comments with the fact that most
Telco's
and large ISP/C's are very slightly concerned with SMTP connectionsm
hence
this discussion line has very little concern to the internet community
with respect to security concerns with LDAP.  That is not to say that
there
is not a need however...  Moshe, please feel free to coment here..  Ok?


Jim Lawson Williams wrote:
> 
> G'day!
> 
> At 04:17 PM 5/17/97 -0700, Paul E. Hoffman wrote:
> >There is nothing in the TLS spec that says
> >anything about the API that is used to tell the higher-level protocol
> (in
> >our case, SMTP).
> 
> Oh, dear! No man's land. "Mere implementation detail, m'boy! Don't you
> 
> worry about that!"

  Good satyre here.  >;)
> 
> I would have hoped that this might have been the forum to express what
> 
> developers expect from an API: timer-management, for example. To take
> the
> specification cited, 6.2.1 states
> 
> The client and the server must share knowledge that the
> connection is ending in order to avoid a truncation attack...
> ...Each party is required to send a close_notify alert before
> closing the write side of the connection.
> 
> but skirts assigning responsibilities for what's supposed to
> happen at the client-end if the server's close_notify response
> seems to be lost, stolen, or strayed. I, for one, think the
> proper place for such time-outs is down in the TLS impementation.
> I would, however, like to see some level of control vested in the
> application layer.

  I agree, TLS is where this control ought to be, Jim.
> 
> I would like the options of saying "TLS, you take care of this
> connection and manage the whole thing", or, alternatively, in the
> extreme, "TLS, accumulate statistics on the initial hand-shake
> round-trip times. Set a default time-out from them, and tell me
> the average and maximum round-trips, and what timeout you're
> about to set so that I can override that last value should I want
> to. Tell me if a close-notify time-out occurs so that I can
> decide whether to wait a little longer, or to terminate the
> session with extreme prejudice."

  Real good alternitive suggestion.  Maybe this should be brought
up with Win Tereese's group(TLS)?  I like it.  
> 
> I appreciate that the immediate concern is the swift deployment
> of SMTP/TLS rather than some obscure and currently theoretical
> application for one list-member, but if this is not the place to
> discuss an "application view" of TLS APIs, where is?

  Well I think that there is some overlap here. As you can tell by the
headers on this reply I am copying the TLS group on this reply, in that
it seems to me that you have a point.  But better and closer interaction
between
LDAP and TLS WG's is in order here.  Win T, any comments here?
> 
> Regards,
> Jim LW
> 
> >From the BBC's "Barchester Chronicles":
> 
> "I know that ultimately we are not supposed to understand.
> But I also know that we must try."
> 
> -- the Reverend Septimus Harding,
> crypt-analyst, art-critic, tax-consultant, C++ programmer,
> humanitarian
> 
> (If vegetarians eat vegetables, what do humanitarians eat?
> Humane beans, perhaps?)

Regards,
-- 
Jeffrey A. Williams
DIR. Internet Network Eng/SR. Java Development Eng.
Information Eng. Group. 
Phone :913-294-2375 (v- office)
E-Mail [email protected]