Re: [apps-discuss] Resending: APPSDIR review of draft-ietf-kitten-gssapi-naming-exts-14

[Nico Williams <[e-mail]>]

On Tue, Apr 17, 2012 at 8:23 PM, William Mills <[e-mail]> wrote:
> OK, if this is covered by the mechanisms (which is something a GSS expert
> probably knows but I did not) then I'm less worried.  Is it then worthwhile
> to add "Systems must know how to interpret critical mechanism attributes,
> but this is already required by mechanism specifications." in the section
> we're talking about to make it explicit rather than implicit?

Yes.  I like the conciseness of the text you propose.  The I had in
mind was something like this:

   The manner in which name attributes are conveyed by GSS
   mechanisms is mechanism-specific.  If a GSS mechanism
   provides a way to indicate criticality then local policy MAY
   require that any given GSS name attribute be expressed using
   critical elements of the mechanism.  However, criticality is not
   exposed in this API because criticality is intended to be handled
   by local policy and the mechanisms.  This means that a system
   that lacks local policy by which to deal with critical mechanism
   elements conveying name attributes should fail security context
   establishment when such critical elements are used by the
   peer.

That's quite a mouthful, so I tend to prefer your text.

Nico
--