Subject: Re: IPP> Re: ADM - Draft minutes [client security issues]

From: [email-masked] (Robert Herriot)
Date: Thu, 18 Dec 1997 14:32:19 -0800

> From [email-masked] Thu Dec 18 07:00:27 1997
> 
> > The IETF ADs are just plain WRONG about this
> > one!  Security should be a customer purchasing choice, not a "cost of
> > doing business using Internet 'standards track' protocols"!  If IPP
> > actually does supplant LPR in the enterprise network (as we all hope)
> > MOST of the printers and clients will be configured WITHOUT security.
> 
> We respectfully disagree.  Internet standards specify requirements
> for interoperability over the entire Internet, not just in an 
> enterprise network.  Many enterprise networks also need security.
> 
> Be assured that the requirement for strong, mandatory, interoperable
> authentication will not be changed.
> 

Your comments above suggest to me that authentication (of a client) is
required and that privacy and mutual authentication are not.

So, would it be acceptable for IPP to drop TLS and require that all IPP
clients and servers support HTTP/1.1 digest authentication?

---

From: Keith Moore <[email-masked]>
Date: Thu, 18 Dec 1997 18:34:30 -0500

> required and that privacy and mutual authentication are not.

That's pretty much my opinion.  Printers have real and significant
costs associated with their use, so some kind of authentication is needed.

> clients and servers support HTTP/1.1 digest authentication?

Not without explaining how this will scale to IPP's anticipated use.

The problem is that IPP wants print servers all over the world
to be usable from anywhere by any IPP client.   Shared secrets
don't even scale to medium size workgroups, much less user 
populations of the size of the Internet.

Most printers aren't suitable for providing service to all comers
anyway, so it doesn't make sense to require all printers to support 
scalable authentication.  But you clearly want clients to be able 
to print to any of: local printers, printers in their office/workgroup/
building, and printers in Kinko's and Sir Speedy's and other service 
providers that will be out there.  Wasn't this a primary goal of IPP?

So if IPP wants clear direction about what's likely to get past IESG, 
I'll say that clients MUST support both digest and TLS, and servers 
MUST support digest and MAY support TLS.  

The alternative is for IPP to convince IESG that digest authentication
alone really is adequate for a wide variety of printer authentication 
scenarios.   I won't claim that it cannot be done, but offhand, I don't
see how to do this.

Keith

---

From: [email-masked]
Date: Fri, 19 Dec 1997 13:43:57 +0100

[email-masked] said:
> The alternative is for IPP to convince IESG that digest 
> authentication alone really is adequate for a wide variety of printer 
> authentication  scenarios.   I won't claim that it cannot be done, 
> but offhand, I don't see how to do this. 

The third alternative is, of course, to claim that the WG is now convinced
that it's acceptable for an IPP client to be unable to print on any
printer that requires non-shared-secret authentication.
This did not seem to be the consensus in Washington, but after all,
the list, not the meeting, is the final arbiter of IETF WG consensus.

Remember - you are the domain experts who are supposed to know what the
requirements for a print protocol are; the IESG requirement is that:

- It's possible for all conformant implementations to be able to
  interwork, if configured to do so
- Whatever functions must be implemented use neither cleartext passwords
  nor encumbered technology, if possible

If ability of a client to print on a TLS-only-configured printer is not
in your requirements set, then that should not be a requirement.

                   Harald A