Re: [CHANNEL-BINDING] Re: draft-ietf-sasl-gs2 AD review comments

Jeffrey Hutzelman <jhutz@cmu.edu> writes:

> On Thu, 11 Oct 2007, Nicolas Williams wrote:
>
>> On Thu, Oct 11, 2007 at 01:28:07PM -0400, Jeffrey Hutzelman wrote:
>> > This sort of assumes that the "obvious" thing to do is prfix the name to
>> > the data, rather than treating them separately.  That sssumption seems
>> > flawed to me, and the source of much confusion.
>>
>> Did you miss this part of my reply to Sam:
>>
>> Nico> I propose the following addition to that requirement:  "Where the
>> Nico> authentication interfaces provide a slot for channel binding data but no
>> Nico> slot for channel binfing type, then the application MUST prefix the
>> Nico> US-ASCII name of the channel binding type ("prefix"), and a separator
>> Nico> character, ':', to the channel binding data an octet string."
>
> I saw that; I just forgot to say anything.  That basically sounds like my
> option (2).  I think that's probably sufficient.  Simon?

It is a starting point, but the proposed text appears to use incorrect
terminology.  Section 7.1 in on-channel-binding says:

   o  Subject: Registration of channel binding X

   o  Channel binding unique prefix (name):

   o  Channel binding type: (One of "unique" or "end-point")

   o  Channel type: (E.g., TLS, IPsec, SSH, etc...)

>From that I infer that:

  channel binding unique prefix = channel binding name

  channel binding type = either 'unqiue' or 'end-point'

  channel type = not an octet string, but a reference to other
    authentication protocols (e.g., TLS RFC 4346).

The proposed text above seem to claim that the channel binding type is
the prefix, which seems incorrect.  I also wonder whether it doesn't
mean 'channel binding unique prefix' rather than 'channel binfing type'.
There is also a spurious 'an' at the end.

I suggest modified text:

  Where the authentication interfaces provide a slot for channel binding
  data but no slot for the channel binding name (i.e., the unique
  prefix), then the application MUST prefix the US-ASCII name of the
  channel binding name (i.e., the unique prefix), and a separator
  character, ':', to the channel binding data octet string.

However, I continue to doubt that anyone that did not read mailing list
discussions about these fine points will be able to do the right thing
when reading the on-channel-bindings document.  The terminology
definitions we are basing this discussion is in the IANA Considerations!
They aren't used earlier in the document.  I think they should be in
section 2, and used throughout the document.  That may be sufficient to
make things understandable.

/Simon

_______________________________________________
CHANNEL-BINDING mailing list
CHANNEL-BINDING@ietf.org
https://www1.ietf.org/mailman/listinfo/channel-binding