Re: SSL Mutual Authentication and the Message Service Spec

[Arvola Chan <arvola@tibco.com>]

Dan:

Thanks for pointing out the relevant use case. I was just trying to
find out if there is a need to augment the CPA with user and
password information to allow basic authentication to be performed.

Do you think the 1.1 MSG and CPP/A specs need to be aligned
with respect to the issue of basic authentication?

Regards,
-Arvola

-----Original Message-----
From: Dan Weinreb <dlw@exceloncorp.com>
To: arvola@tibco.com <arvola@tibco.com>
Cc: ebxml-cppa@lists.oasis-open.org <ebxml-cppa@lists.oasis-open.org>;
ebxml-msg@lists.oasis-open.org <ebxml-msg@lists.oasis-open.org>
Date: Monday, August 27, 2001 8:36 PM
Subject: Re: SSL Mutual Authentication and the Message Service Spec


>   Date: Thu, 23 Aug 2001 09:41:08 -0700
>   From: Arvola Chan <arvola@tibco.com>
>
>   More changes to the CPP/A spec will be necessary to support Basic
>   Authentication. However, I seriously doubt if basic authentication which
>   sends user name and password in cleartext is suitable for conducting E
>   business transactions. Perhaps we should lobby the MSG TC to remove the
>   requirement to support basic authentication in the 1.1 spec.
>
>I agree that sending passwords in cleartext is right out, but perhaps
>what's being contemplated here is using Basic Authentication over an
>HTTPS (SSL/TLS) connection to do client authentication in cases where
>the client doesn't have a private key and associated digital
>certificate.  That scenario arises a lot in "B2C"; I don't know how
>likely it is to come up in ebXML interactions.
>