> Keith Moore wrote:
> >
> > Servers are REQUIRED to implement "TLS + Basic" OR Digest.
> >
> > Clients are REQUIRED to implement Digest. If the client
> > supports TLS then it is also REQUIRED to support "TLS + Basic".
> >
> > Won't fly, because it doesn't ensure interoperability.
>> Requiring TLS in all clients will force non-compliant clients.
perhaps. if that's really the case, then it would probably be
better for everyone to implement digest. but I don't think
that RSA licensing should be a barrier, because TLS doesn't
require RSA.
> Also, after looking at TLS more closely, TLS poses additional
> interoperability concerns (specifically, there are no required
> ciphers, only recommended ones.)
Where do you get that idea? From RFC 2266:
] 9. Mndatory Cipher Suites
]
] In the absence of an application profile standard specifying
] otherwise, a TLS compliant application MUST implement the cipher
] suite TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.
> If a TLS-capable server and
> client can't find a common cipher to use, then they either have to
> send data in the clear or drop the connection, which either kills
> security or interoperability (take your pick)...
Every application that uses TLS has to either choose a mandatory-to-implement
cipher or is implicitly (by referencing the TLS spec) required to implement
TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA.
Keith