Subject: Protocol Action: Using TLS with IMAP, POP3 and ACAP to Proposed Standard

From: The IESG <[email-masked]>
Date: Wed, 21 Apr 1999 16:04:15 -0400

The IESG has approved the Internet-Draft 'Using TLS with IMAP, POP3 and
ACAP' <draft-newman-tls-imappop-09.txt> as a Proposed Standard.  This
has been reviewed in the IETF but is not the product of an IETF Working
Group.  The IESG contact persons are Keith Moore and Patrik Faltstrom.

Technical Summary
 
This specification defines extensions to IMAP, POP, and ACAP which
activate TLS.  It also defines a simple PLAIN SASL mechanism for
use underneath strong TLS encryption with ACAP or other protocols
which lack a clear-text login command.

This document therefore provides (a) privacy and (b) two additional
authentication methods for use with these protocols:

1. TLS authentication with client certificates
   (if client and server each support the SASL EXTERNAL mechanism)
2. authentication using passwords over an encrypted channel
   (using either the SASL PLAIN mechanism, or the IMAP LOGIN
    command, or the POP USER command)

The latter method allows authentication using existing non-invertable
password databases, without exposing the password to eavesdroppers.

This method of using TLS with these protocols is considered preferable
to the currently deployed method of using a separate port for 'secure'
IMAP or POP.

Working Group Summary

This document was not developed by a working group but has been
discussed on several mailing lists, notably [email-masked].
It has mostly been uncontroversial, and except for one point
(to be arbitrated by IESG) there appears to be rough consensus
on the result.
Protocol Quality

The protocol appears to be a sound means of layering TLS on top
of existing protocols, and the document pays adequate attention
to the various implementation and operational issues associated
with doing so.

Keith Moore reviewed the specification for IESG.