Mailing-List: contact derby-user-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Derby Discussion" <derby-user@db.apache.org>
Received-SPF: pass (herse.apache.org: domain of david.vancouvering@gmail.com
 designates 209.85.146.183 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:sender:to:subject:in-reply-to:mime-version:content-type:content-transfer-encoding:content-disposition:references:x-google-sender-auth;
        b=T2hzhrlMzG5QKjz6/j4ftGbvWpeebZ/wDal/ZTR+ThVPKU0Ii8mijBBq9C2pxyNPd/fkDDppSwchM4UlI3lsv018+juoCbE0oQb/cxCcwLH8W2izM/Qe5inLYgpy+SE3UGwyZJnPSQzgJPe7s/AWRcMv63UuRuFFrYJiZHcwi74=
Message-ID: <56a83cd00706171807s5e530df0n3ac16f3989f75545@mail.gmail.com>
Date: Sun, 17 Jun 2007 18:07:59 -0700
From: "David Van Couvering" <david@vancouvering.com>
Sender: david.vancouvering@gmail.com
To: "Derby Discussion" <derby-user@db.apache.org>
Subject: Re: User/password encryption and deployment
In-Reply-To: <54ac72d70706160035q32acd2e0t1fda00a0aa98e41@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
References: <20070616025707.5198152529@dbrack01.segel.com>
	 <46736F59.2030804@sun.com>
	 <54ac72d70706160035q32acd2e0t1fda00a0aa98e41@mail.gmail.com>

Hi, Andrew.  This is helpful, thanks.  But my attempts to find out how
to "use" SSL/TLS is not clear.  Is there a way to use this over any
old TCP socket connection?  The closest thing I can find is STARTTLS,
which is what Bill was referring to, but this appears to require
cooperation within the network code.  A regular old user of Derby
doesn't seem to have the power to make a connection happen over SSL

S when you say "SSL is the recommended alternative," exactly what do
you mean?  How would you tell a user to *do* this?

Thanks,

David

On 6/16/07, Andrew McIntyre <mcintyre.a@gmail.com> wrote:
> On 6/15/07, Bill Shannon <bill.shannon@sun.com> wrote:
> >
> > I think the idea is to protect the communication between the client
> > and the server so that passwords aren't sent in the clear.  None of
> > the data being stored in the database is being encrypted, just the
> > client/server communication.
> >
> > It *is* 2007.  Isn't this pretty much standard by now?
>
> See the discussion in http://issues.apache.org/jira/browse/DERBY-65
>
> SSL is the recommended alternative to using the secure password
> protocol defined by the DRDA specification. Bernt Johnsen worked on
> this for 10.3, due out shortly, and it appears to be complete:
>
> https://issues.apache.org/jira/browse/DERBY-2108
>
> andrew
>