Subject: Security and WebDAV

From: Max Elander <[email-masked]>
Date: Fri, 09 Mar 2001 09:29:46 +0100

Hi!

I have been lurking on the list for a couple of weeks now and thought I¹d
come out of the shadows to ask a question that I haven¹t seen anyone else
addressing:

How about security? I understand that as DAV uses http as the underlying
protocol, I can use SSL as a way to enhance security, and realms on my
server to exclude unwanted visitors.

What I am more interested in is if there is any support in current clients
for more rigorous security, eg RSA encryption or similar approaches?

If I use a webclient such as IE or Netscape the answer is rather obvious,
but how is it with webfolders in Windows, how will it work in Mac OS X, does
Adobe support it in Photoshop and InDesign, has Microsoft done anything like
that in Office 2000, Office XP and so forth?

If this is a topic on another list, please let me know.

Regards, Max Elander
(Content Manager, AcadeMedia World)

---

From: "Jim" <[email-masked]>
Date: Fri, 9 Mar 2001 09:35:17 -0500

Hi,

I've been lurking too and I saw your post.

Before I got off and say that SSL can still take care of all your needs, can
you be more specific about which RSA security protocols you are interested
in?   SSL supports pretty much the same authentication and encryption
options that IPSec does without all the nasty, messy NAT issues.

If you run all your TCP connections under/over SSL, it would address your
webfolders question as well.   Furthermore, it is feasibly possible to run
SSL in both directions, therefore providing authentication of the clients.

Regards,
Jim

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]]On Behalf Of Max Elander
Sent: Friday, March 09, 2001 3:30 AM
To: WebDAV-listan
Subject: Security and WebDAV

Hi!

Regards, Max Elander

---

From: "Lisa Dusseault" <[email-masked]>
Date: Fri, 9 Mar 2001 08:35:24 -0800

"SSL or RSA" is a category error. SSL is a protocol that uses various
encryption algorithms. RSA is the key exchange and digital signature
algorithm most commonly used by SSL.  What exactly is it you're trying
to do that you think that SSL can't do?

For more information on the interaction between HTTP and SSL, check
out RFC 2817 and RFC 2818 or a book on SSL (the two SSL books are
Rescorla and Thomas).

I don't know for sure, but I can make some reasonable surmises about
how Web Folders works.  If it uses the same internet layer that other
MS applications do, and I'm fairly certain it does, then it will
recognize URLs that are for HTTP over SSL ("https:") and act accordingly.
I do know Web Folders will prompt the user for a username/password if
it attempts to access protected resources on a server and gets the
right error back.

It should work the same in any other WebDAV client on any platform.
The use of HTTP with SSL is a well-understood problem with an
interoperable standards-based solution.

Lisa

> Sent: Friday, March 09, 2001 12:30 AM
> To: WebDAV-listan