Subject: [caldav] draft-desruisseaux-caldav-sched-09 / question concerning Security

From: Bernie Hoeneisen <[email-masked]>
Date: Mon, 7 Feb 2011 11:56:36 +0100 (CET)

Dear authors of draft-desruisseaux-caldav-sched

I was going through draft-desruisseaux-caldav-sched and came across 
something rather confusing:

- In the Security Considerations of draft-desruisseaux-caldav-sched, the 
following is specified:

   "Servers and clients MUST use an HTTP connection protected with
    TLS as defined in [RFC2818] for all scheduling transactions."

- RFC 2818 requires:

    "2.4.  URI Format
    HTTP/TLS is differentiated from HTTP URIs by using the 'https'
    protocol identifier in place of the 'http' protocol identifier."

- However, in the IANA Considerations section 16.1 (only) "http" is 
requested for IANA registration:

   "Applicable protocol: http"

This appears rather contradictionary to me. Can you please enlight me 
regarding this matter? I assume that some correction (or at least 
clarification) is needed in draft-desruisseaux-caldav-sched.

cheers,
  Bernie

PS:
The clarification of this question is relevant for an update of RFC 5333, 
which specifies the Enumservices for Calendaring. [FYI: I am author of RFC 
5333 as well as ENUM WG Chair.]

--

http://ucom.ch/
Tech Consulting for Internet Standardization

---

From: Julian Reschke <[email-masked]>
Date: Mon, 07 Feb 2011 12:25:55 +0100

On 07.02.2011 11:56, Bernie Hoeneisen wrote:
> ...

Although the spec requires use of HTTPS, the base protocol is still 
"http". There is no separate header field registry for "https" (and that 
would really be bad).

BR, Julian

---

From: Bernie Hoeneisen <[email-masked]>
Date: Mon, 7 Feb 2011 13:27:26 +0100 (CET)

Hi Julian

Thanks for your fast reply.
My comments inline.

On Mon, 7 Feb 2011, Julian Reschke wrote:

> Although the spec requires use of HTTPS, the base protocol is still "http". 
> There is no separate header field registry for "https" (and that would really 
> be bad).

I see. This explains at least part of the confusion.

The actual question I need an answer to is:

If someone advertises a URI for Internet Calendar scheduling, which URI 
Schemes are permitted in said URI?

Besides 'mailto', I see at least 'https'.
But would 'http' also be permitted? (I guess not.)
Any further URI Schemes used for Internet Calendaring?

If this has been specified somewhere, I'd be glad to receive some 
pointers.

cheers,
  Bernie