OASIS ebXML Messaging Services TC

 View Only

Re: SSL Mutual Authentication and the Message Service Spec

  • 1.  Re: SSL Mutual Authentication and the Message Service Spec

    Posted 08-27-2001 23:38
       Date: Thu, 23 Aug 2001 09:41:08 -0700
       From: Arvola Chan <arvola@tibco.com>
    
       More changes to the CPP/A spec will be necessary to support Basic
       Authentication. However, I seriously doubt if basic authentication which
       sends user name and password in cleartext is suitable for conducting E
       business transactions. Perhaps we should lobby the MSG TC to remove the
       requirement to support basic authentication in the 1.1 spec.
    
    I agree that sending passwords in cleartext is right out, but perhaps
    what's being contemplated here is using Basic Authentication over an
    HTTPS (SSL/TLS) connection to do client authentication in cases where
    the client doesn't have a private key and associated digital
    certificate.  That scenario arises a lot in "B2C"; I don't know how
    likely it is to come up in ebXML interactions.