Re: draft minutes from Chicago meeting

[Chris Newman <Chris.Newman@INNOSOFT.COM>]

On Mon, 28 Sep 1998, John C. Strassner wrote:
> I still think that a good approach to ensure mandatory-to-implement
> compatibility is to divide the problem in two. Force servers to implement
> TLS plus one of either the compromise or CRAM-MD5, and force clients to
> implement either TLS or the non-TLS option chosen for the server. This way,
> applications that mandate strong authentication can rely on TLS, and
> applications that don't can rely on the lighter weight option.

My understanding is the current model is that implementations MUST
implement DIGEST-MD5/CRAM-MD5 (whichever the WG chooses) and SHOULD
implement TLS.

I'm opposed to making TLS a MUST for clients, but I don't see a big
problem with making it a MUST for servers (although TLS is a *lot* more
code than should be necessary for the level of security it provides). 
Note that the mandatory-to-implement cipher suite in TLS is DHE_DSS +
triple-DES, so an export-crippled server would be non-compliant with the
spec.  This may or may not be a big deal.

		- Chris