Subject: Re: IPP> Re: ADM - Draft minutes [client security issues]

From: Carl-Uno Manros <[email-masked]>
Date: Fri, 19 Dec 1997 07:09:51 -0800

At 01:43 PM 12/19/97 +0100, [email-masked] wrote:
>
>[email-masked] said:
>> The alternative is for IPP to convince IESG that digest 
>> authentication alone really is adequate for a wide variety of printer 
>> authentication  scenarios.   I won't claim that it cannot be done, 
>> but offhand, I don't see how to do this. 
>
>The third alternative is, of course, to claim that the WG is now convinced
>that it's acceptable for an IPP client to be unable to print on any
>printer that requires non-shared-secret authentication.
>This did not seem to be the consensus in Washington, but after all,
>the list, not the meeting, is the final arbiter of IETF WG consensus.
>
>Remember - you are the domain experts who are supposed to know what the
>requirements for a print protocol are; the IESG requirement is that:
>
>- It's possible for all conformant implementations to be able to
>  interwork, if configured to do so
>- Whatever functions must be implemented use neither cleartext passwords
>  nor encumbered technology, if possible
>
>If ability of a client to print on a TLS-only-configured printer is not
>in your requirements set, then that should not be a requirement.
>
>                   Harald A

Well,

It seems that Harald has a more liberal view on this than Keith. This seems
to open up the possibility to to recommend that all clients SHOULD support
TLS, but not make it an absolute MUST.

Comments?

Carl-Uno

---

From: Jay Martin <[email-masked]>
Date: Fri, 19 Dec 1997 11:59:39 -0500

Carl-Uno,

> TLS, but not make it an absolute MUST.

One question I have has to do with the implementation complexity
of adding TLS support to a client.  (I have no experience in TLS
at all, neither the protocol nor the implementation.)

Is it difficult?  Is there a public domain (ie, free) implementation
of TLS that can be leveraged to provide TLS support in a client?

If it's free (or very, very cheap) and it's easy to integrate,
then I would be quite willing to get behind mandatory TLS support
in IPP clients.

	...jay

----------------------------------------------------------------------
--  JK Martin               |  Email:   [email-masked]          --
--  Underscore, Inc.        |  Voice:   (603) 889-7000              --
--  41C Sagamore Park Road  |  Fax:     (603) 889-2699              --
--  Hudson, NH 03051-4915   |  Web:     http://www.underscore.com   --
----------------------------------------------------------------------

---

From: Randy Turner <[email-masked]>
Date: Fri, 19 Dec 1997 10:19:22 -0800

How long are we going to keep revisiting
this issue? We have a solution that meets
our charter and I thought we had consensus.

What IPP over TCP?
What about fonts?
Do we use binary or ASCII encoding?

I think we have a model and have resolved
our issues. Lets go with this and see what
happens in the deployment of the proposed
standard we have....

Randy