Re: [CHANNEL-BINDING] Re: draft-ietf-sasl-gs2 AD review comments

On Wed, 10 Oct 2007, Nicolas Williams wrote:

> On Wed, Oct 10, 2007 at 10:55:52AM -0400, Sam Hartman wrote:
> >     Nicolas> I believe the text of the I-D is clear on the above.
> >     Nicolas> Thus your protocol issues are taken care of.
> >
> > Well, my reading of the ID is that the protocol needs two slots--one
> > for a prefix and one for a channel binding octec string.  Simon is
> > arguing that we only want to have one slot.
> > I'm fine with that if we want to make that change.
>
> I don't agree.  The I-D is clear on channel bindings being a single
> octet string.  The prefix is a US-ASCII string prefixed to the raw
> channel binding octet string.  After the prefix is added you still have
> a single octet string.

Ah, but the spec doesn't actually _say_ that.  It doesn't actually say
anywhere that the prefix is prepended to the channel-specific binding
data, resulting in a single octet string for the application to transport.
On the other hand, it _does_ say that the application needs to distinguish
channel types based on the prefix, which suggests (but only suggests) that
they are treated as separate items.

If it's a single string, then you need a separator, for two reasons:

- Without it, it's not good enough for prefixes to be unique; it must be
  the case that no prefix is an initial substring of another.

- Without a separator, it is difficult for the application (or library)
  to separate the prefix from the data, which it must do in order to
  determine the channel type, which affects interpretation of the data.

Of course, one could use another approach, like a counted string, or a
fixed-width field, or a fixed-size integer.  I don't care much.

> Simon's issue, I thought, was about API slots.

I suppose we should let Simon speak for himself, but I believe his issue
was about supporting channel bindings in SASL-GS2.

_______________________________________________
CHANNEL-BINDING mailing list
CHANNEL-BINDING@ietf.org
https://www1.ietf.org/mailman/listinfo/channel-binding