From bernie@ietf.hoeneisen.ch Mon Feb 7 02:56:41 2011 Return-Path: X-Original-To: caldav@core3.amsl.com Delivered-To: caldav@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id C8BC83A6D85 for ; Mon, 7 Feb 2011 02:56:41 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -100.74 X-Spam-Level: X-Spam-Status: No, score=-100.74 tagged_above=-999 required=5 tests=[BAYES_20=-0.74, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 09ezsV5Z3oxZ for ; Mon, 7 Feb 2011 02:56:40 -0800 (PST) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) by core3.amsl.com (Postfix) with ESMTP id 87D9D3A6D6C for ; Mon, 7 Feb 2011 02:56:37 -0800 (PST) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.71) (envelope-from ) id 1PmOlo-0005HC-QV; Mon, 07 Feb 2011 11:56:36 +0100 Date: Mon, 7 Feb 2011 11:56:36 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: draft-desruisseaux-caldav-sched@tools.ietf.org Message-ID: User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Cc: caldav@ietf.org Subject: [caldav] draft-desruisseaux-caldav-sched-09 / question concerning Security X-BeenThere: caldav@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2011 10:56:41 -0000 Dear authors of draft-desruisseaux-caldav-sched I was going through draft-desruisseaux-caldav-sched and came across something rather confusing: - In the Security Considerations of draft-desruisseaux-caldav-sched, the following is specified: "Servers and clients MUST use an HTTP connection protected with TLS as defined in [RFC2818] for all scheduling transactions." - RFC 2818 requires: "2.4. URI Format HTTP/TLS is differentiated from HTTP URIs by using the 'https' protocol identifier in place of the 'http' protocol identifier." - However, in the IANA Considerations section 16.1 (only) "http" is requested for IANA registration: "Applicable protocol: http" This appears rather contradictionary to me. Can you please enlight me regarding this matter? I assume that some correction (or at least clarification) is needed in draft-desruisseaux-caldav-sched. cheers, Bernie PS: The clarification of this question is relevant for an update of RFC 5333, which specifies the Enumservices for Calendaring. [FYI: I am author of RFC 5333 as well as ENUM WG Chair.] -- http://ucom.ch/ Tech Consulting for Internet Standardization From julian.reschke@gmx.de Mon Feb 7 03:25:57 2011 Return-Path: X-Original-To: caldav@core3.amsl.com Delivered-To: caldav@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 8BEF83A6DD1 for ; Mon, 7 Feb 2011 03:25:57 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -102.599 X-Spam-Level: X-Spam-Status: No, score=-102.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nxvwJ38dBj85 for ; Mon, 7 Feb 2011 03:25:56 -0800 (PST) Received: from mailout-de.gmx.net (mailout-de.gmx.net [213.165.64.23]) by core3.amsl.com (Postfix) with SMTP id 2D4C53A6DD0 for ; Mon, 7 Feb 2011 03:25:55 -0800 (PST) Received: (qmail invoked by alias); 07 Feb 2011 11:25:58 -0000 Received: from mail.greenbytes.de (EHLO [192.168.1.134]) [217.91.35.233] by mail.gmx.net (mp027) with SMTP; 07 Feb 2011 12:25:58 +0100 X-Authenticated: #1915285 X-Provags-ID: V01U2FsdGVkX1/eaCgZ3Wne0JhW4TeKb8bhcDXgD5zQixoe53Mhgr 1iAKJZtifomqxN Message-ID: <4D4FD6C3.8030206@gmx.de> Date: Mon, 07 Feb 2011 12:25:55 +0100 From: Julian Reschke User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20101207 Lightning/1.0b2 Thunderbird/3.1.7 MIME-Version: 1.0 To: Bernie Hoeneisen References: In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit X-Y-GMX-Trusted: 0 Cc: draft-desruisseaux-caldav-sched@tools.ietf.org, caldav@ietf.org Subject: Re: [caldav] draft-desruisseaux-caldav-sched-09 / question concerning Security X-BeenThere: caldav@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2011 11:25:57 -0000 On 07.02.2011 11:56, Bernie Hoeneisen wrote: > Dear authors of draft-desruisseaux-caldav-sched > > I was going through draft-desruisseaux-caldav-sched and came across > something rather confusing: > > - In the Security Considerations of draft-desruisseaux-caldav-sched, the > following is specified: > > "Servers and clients MUST use an HTTP connection protected with > TLS as defined in [RFC2818] for all scheduling transactions." > > - RFC 2818 requires: > > "2.4. URI Format > HTTP/TLS is differentiated from HTTP URIs by using the 'https' > protocol identifier in place of the 'http' protocol identifier." > > - However, in the IANA Considerations section 16.1 (only) "http" is > requested for IANA registration: > > "Applicable protocol: http" > > > This appears rather contradictionary to me. Can you please enlight me > regarding this matter? I assume that some correction (or at least > clarification) is needed in draft-desruisseaux-caldav-sched. > ... Although the spec requires use of HTTPS, the base protocol is still "http". There is no separate header field registry for "https" (and that would really be bad). BR, Julian From bernie@ietf.hoeneisen.ch Mon Feb 7 04:27:26 2011 Return-Path: X-Original-To: caldav@core3.amsl.com Delivered-To: caldav@core3.amsl.com Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 018563A6D6B for ; Mon, 7 Feb 2011 04:27:26 -0800 (PST) X-Virus-Scanned: amavisd-new at amsl.com X-Spam-Flag: NO X-Spam-Score: -101.669 X-Spam-Level: X-Spam-Status: No, score=-101.669 tagged_above=-999 required=5 tests=[AWL=0.930, BAYES_00=-2.599, USER_IN_WHITELIST=-100] Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 861H-z6qhpho for ; Mon, 7 Feb 2011 04:27:25 -0800 (PST) Received: from softronics.hoeneisen.ch (softronics.hoeneisen.ch [62.2.86.178]) by core3.amsl.com (Postfix) with ESMTP id 05A5C3A68AD for ; Mon, 7 Feb 2011 04:27:24 -0800 (PST) Received: from localhost ([127.0.0.1]) by softronics.hoeneisen.ch with esmtp (Exim 4.71) (envelope-from ) id 1PmQBi-0005Nw-I0; Mon, 07 Feb 2011 13:27:26 +0100 Date: Mon, 7 Feb 2011 13:27:26 +0100 (CET) From: Bernie Hoeneisen X-X-Sender: bhoeneis@softronics.hoeneisen.ch To: Julian Reschke In-Reply-To: <4D4FD6C3.8030206@gmx.de> Message-ID: References: <4D4FD6C3.8030206@gmx.de> User-Agent: Alpine 2.00 (DEB 1167 2008-08-23) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; format=flowed; charset=US-ASCII X-SA-Exim-Connect-IP: 127.0.0.1 X-SA-Exim-Mail-From: bernie@ietf.hoeneisen.ch X-SA-Exim-Scanned: No (on softronics.hoeneisen.ch); SAEximRunCond expanded to false Cc: draft-desruisseaux-caldav-sched@tools.ietf.org, caldav@ietf.org Subject: Re: [caldav] draft-desruisseaux-caldav-sched-09 / question concerning Security X-BeenThere: caldav@ietf.org X-Mailman-Version: 2.1.9 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 07 Feb 2011 12:27:26 -0000 Hi Julian Thanks for your fast reply. My comments inline. On Mon, 7 Feb 2011, Julian Reschke wrote: > On 07.02.2011 11:56, Bernie Hoeneisen wrote: >> Dear authors of draft-desruisseaux-caldav-sched >> >> I was going through draft-desruisseaux-caldav-sched and came across >> something rather confusing: >> >> - In the Security Considerations of draft-desruisseaux-caldav-sched, the >> following is specified: >> >> "Servers and clients MUST use an HTTP connection protected with >> TLS as defined in [RFC2818] for all scheduling transactions." >> >> - RFC 2818 requires: >> >> "2.4. URI Format >> HTTP/TLS is differentiated from HTTP URIs by using the 'https' >> protocol identifier in place of the 'http' protocol identifier." >> >> - However, in the IANA Considerations section 16.1 (only) "http" is >> requested for IANA registration: >> >> "Applicable protocol: http" >> >> >> This appears rather contradictionary to me. Can you please enlight me >> regarding this matter? I assume that some correction (or at least >> clarification) is needed in draft-desruisseaux-caldav-sched. >> ... > > Although the spec requires use of HTTPS, the base protocol is still "http". > There is no separate header field registry for "https" (and that would really > be bad). I see. This explains at least part of the confusion. The actual question I need an answer to is: If someone advertises a URI for Internet Calendar scheduling, which URI Schemes are permitted in said URI? Besides 'mailto', I see at least 'https'. But would 'http' also be permitted? (I guess not.) Any further URI Schemes used for Internet Calendaring? If this has been specified somewhere, I'd be glad to receive some pointers. cheers, Bernie