[NNTP] STARTTLS diffs

[Jeffrey M. Vinocur]

On Jun 10, 2005, at 12:39 PM, Ken Murchison wrote:

> +     network is no longer appropriate, and sometimes integrity and/or
> +     confidentiality protection is desired for the entire connection.

"are desired"?  I'm not sure how to conjugate with an "and/or" but the 
"is" looks funny to me.


> -     The STARTTLS extension provides a way to use the popular TLS 
> [TLS]
> -     service with the existing NNTP protocol.  [...]

I really like what you did with this paragraph.


> +     [...] TLS is complimentary to simple
> +     authentication-only SASL mechanisms or deployed clear-text 
> password
> +     login commands.

         TLS is complimentary to both simple, authentication-only SASL
         mechanisms, and widely-deployed clear-text password 
authentication.

?


> +     During the TLS negotiation, the client MUST check its 
> understanding
> +     of the server hostname against the server's identity as presented
> +     in the server Certificate message, in order to prevent 
> man-in-the-
> +     middle attacks.

This is stronger than we had before, and I think I like it.  My only 
hesitation is, I think the user should have the ability to turn off the 
hostname checking (for the case in which he does not expect it to 
match, since that's fairly common at present).

For that to happen, do we have to do something like "the client MUST 
have the ability to check...and this MUST be the default 
configuration"?


-- 
Jeffrey M. Vinocur
jeff at litech.org