Re: [xmpp] DNA transport

Good points. Definitely need the ability to add new domains during a stream,
and most likely don't want the overhead of passing credentials for all
domains that may be used during stream setup. Number of domains could be
large for a big hosting provider.

Jonas

On Sat, Jan 16, 2010 at 12:03 AM, Dave Cridland <dave@cridland.net> wrote:

> On Fri Jan 15 17:31:13 2010, Richard L. Barnes wrote:
>
>> Assuming for the moment that we're going to stick with attribute  certs:
>> Rather than using both TLS and some new XML to carry DNA  information, why
>> not just hand the attribute certs over as part of the  TLS negotiation?
>>  That is, carrying XMPP authorization certs seems  like a natural
>> application of the TLS authorization extensions [1].   That way,
>> implementations can save on the crypto costs (since tls- authz is reportedly
>> already implemented in OpenSSL, GNUTLS, and NSS),  and draft-ietf-xmpp-dna
>> can focus on the AC profile.
>>
>
> Can't - XMPP needs to dynamically add multiple domain credentials on the
> fly during a stream, so I think we'd need to either have a new TLS record
> type, or else carry them in the application protocol.
>
> Carrying them in the application protocol also means we're channel
> independent.
>
> And don't have to wait on the TLS guys quite so long.
>
> Dave.
> --
> Dave Cridland - mailto:dave@cridland.net - xmpp:dwd@dave.cridland.net<xmpp%3Adwd@dave.cridland.net>
>  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
>  - http://dave.cridland.net/
> Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade
>
> _______________________________________________
> xmpp mailing list
> xmpp@ietf.org
> https://www.ietf.org/mailman/listinfo/xmpp
>