Subject: [IPP] 5100.11 : "job-password" and "job-save-disposition"

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Fri, 23 Jun 2017 22:15:08 +0000

Hi there,

Consider a scenario where a Printer receives a Create-Job operation with the following attributes:

job-password="12345678"
job-password-encryption='none'
job-save-disposition=
{
	save-disposition='save-only'
	save-info=
	{
		save-location="whatever"
		save-document-format=application/pdf
	}
}
		
What would one expect the printer to do:

1. Hold the Job in 'pending-held' state until the matching password was provided, then retain the Job as a Saved Job
2. Process the Job to retain the Job as a Saved Job per the definition in 5100.11 section 2.2, but then whenever it might be reprinted via user selection on the control panel, the user is prompted for the password

If the expectation is #1 then there seems to be no way currently in standard IPP to create a password protected Saved Job, which I believe to be a valid use case that IPP needs to support. This could be supported using my (pending) IPP Document Encryption whitepaper, but wondered if it was already supported.

Thoughts?

Smith

/**
    Smith Kennedy
    Wireless Architect - Client Software - IPG-PPS
    Standards - IEEE ISTO PWG / Bluetooth SIG / Wi-Fi Alliance / NFC Forum / USB IF
    Chair, IEEE ISTO Printer Working Group
    HP Inc.
*/

_______________________________________________
ipp mailing list
[email-masked]
https://www.pwg.org/mailman/listinfo/ipp

---

From: Ira McDonald <[email-masked]>
Date: Sat, 24 Jun 2017 10:14:45 -0400

Hi Smith,

This is an interesting question.

Since both Restart-Job and Reprocess-Job are *deprecated*, I note that,
with Resubmit-Job (which creates a *new* job from the saved/retained
job), I would assume that an entirely new job-password would be sent.

That is, I don't believe it's appropriate or reasonable for the saved job
to retain the old one-time-use job-password for the new job created by
the Resubmit-Job operation.

Mike - WDYT?

Cheers,
- Ira

Ira McDonald (Musician / Software Architect)
Co-Chair - TCG Trusted Mobility Solutions WG
Chair - Linux Foundation Open Printing WG
Secretary - IEEE-ISTO Printer Working Group
Co-Chair - IEEE-ISTO PWG Internet Printing Protocol WG
IETF Designated Expert - IPP & Printer MIB
Blue Roof Music / High North Inc
http://sites.google.com/site/blueroofmusic
http://sites.google.com/site/highnorthinc
mailto: [email-masked]
Jan-April: 579 Park Place  Saline, MI  48176  734-944-0094
May-Dec: PO Box 221  Grand Marais, MI 49839  906-494-2434

On Fri, Jun 23, 2017 at 6:15 PM, Kennedy, Smith (Wireless Architect) <
[email-masked]> wrote:

> 1. Hold the Job in 'pending-held' state until the matching password was
> provided, then retain the Job as a Saved Job
> 2. Process the Job to retain the Job as a Saved Job per the definition in
> 5100.11 section 2.2, but then whenever it might be reprinted via user
> selection on the control panel, the user is prompted for the password
>
> If the expectation is #1 then there seems to be no way currently in
> standard IPP to create a password protected Saved Job, which I believe to
> be a valid use case that IPP needs to support. This could be supported
> using my (pending) IPP Document Encryption whitepaper, but wondered if it
> was already supported.
>
> Thoughts?
>
> Smith
>
> /**
>     Smith Kennedy

---

From: "Kennedy, Smith (Wireless Architect)" <[email-masked]>
Date: Sun, 25 Jun 2017 00:17:08 +0000

Hi Ira,

My main concerns are that the "job-password" provided will prevent the Job from being stored when it is received, and that once the password is entered at the Printer, that password won't persist. That doesn't seem to match my expectations as to what the user would want. In the use case I'm thinking about, the Job is sent to be stored and is provided with a password, with the user expecting that it will be stored right away, and that each re-print of that saved job will require that job's password to be entered.

It seems we could solve this using a combination of "document-password" if the "save-document-format"='application/pdf', or possibly using my pending "IPP Document Encryption" system. I would have thought that this combination would have been considered already since  both "job-password" and "job-save-disposition" are defined in the same PWG candidate standard. Language such as :

If a job creation operation is received that includes both "job-password" and "job-save-disposition" where its "save-disposition" member is 'save-only', in this case the Job will NOT be placed in 'pending-held' state but will proceed to "processing" for becoming a "saved job", and the "job-password" will be expected upon each reprint.

From HP's perspective, the reprinting of saved jobs is not performed via IPP Client operations such as the deprecated Restart-Job or Reprocess-Job operation, but by user interactions at the Printer itself, for instance using a physical printer's control panel or web interface, or a print server's management interface.

Smith

/**
    Smith Kennedy

> On Jun 24, 2017, at 8:14 AM, Ira McDonald <[email-masked]> wrote:
> 
> Hi Smith,
> 
> Since both Restart-Job and Reprocess-Job are deprecated, I note that,
> http://sites.google.com/site/blueroofmusic <http://sites.google.com/site/blueroofmusic>
> http://sites.google.com/site/highnorthinc <http://sites.google.com/site/highnorthinc>
> mailto: [email-masked] <mailto:[email-masked]>
> On Fri, Jun 23, 2017 at 6:15 PM, Kennedy, Smith (Wireless Architect) <[email-masked] <mailto:[email-masked]>> wrote:
> Hi there,
> 
> [email-masked] <mailto:[email-masked]>
> https://www.pwg.org/mailman/listinfo/ipp <https://www.pwg.org/mailman/listinfo/ipp>
> 
>

---

From: Michael Sweet <[email-masked]>
Date: Sun, 25 Jun 2017 19:54:20 -0400

Smith,

> On Jun 23, 2017, at 6:15 PM, Kennedy, Smith (Wireless Architect) <[email-masked]> wrote:
> 
> Hi there,
> 

The result should be 1 or a new 3:

3. Treat job-password and job-password-encryption as constrained against job-save-disposition (i.e. the two are incompatible), and either return client-error-conflicting-attributes or successful-ok-ignored-or-substituted-attributes with one or the other in the unsupported attributes group of the response.

The problem with #2 is that you are saving private information (job-password[-encryption]) with the processed job data, which could be a security issue (information disclosure).  Plus the saved job is not necessarily stored on the printer...

> If the expectation is #1 then there seems to be no way currently in standard IPP to create a password protected Saved Job, which I believe to be a valid use case that IPP needs to support. This cou…

What you want is probably the semantic equivalent of document-password in the job-save-disposition ("save-password"), not job-password, however there are issues since we normally send passwords as operation attributes that are not made available as part of the Job or Document objects...

_________________________________________________________
Michael Sweet, Senior Printing System Engineer