Re: Comments on X.509 SASL Authentication Mechanism

[Chris Newman <Chris.Newman@innosoft.com>]

On Fri, 24 Apr 1998, Ed Reed wrote:
> I wonder if this is the time to suggest a slight modification to the
> client authentication mechanism described...
> ...
> Now...what I'm aiming for here is to allow the use of derived
> credentials in lieu of the long-term private key of the user.
> ...

I'd be inclined to say that if you want this, you may as well use a full  
TLS layer.  The first letter of "SASL" is "Simple" and that's the primary
reason why it's useful to be able to use X.509 certs either via SASL or
via TLS, IMHO.

--
                - Chris

"Good security is hard.  X.509 is harder."