Re: [CHANNEL-BINDING] Re: draft-ietf-sasl-gs2 AD review comments

Sam Hartman <hartmans-ietf@mit.edu> writes:

>>>>>> "Nicolas" == Nicolas Williams <Nicolas.Williams@sun.com> writes:
>
>     Nicolas> On Wed, Oct 10, 2007 at 10:55:52AM -0400, Sam Hartman
>     Nicolas> wrote: I believe the text of the I-D is clear on the
>     Nicolas> above.  Thus your protocol issues are taken care of.
>     >>  Well, my reading of the ID is that the protocol needs two
>     >> slots--one for a prefix and one for a channel binding octec
>     >> string.  Simon is arguing that we only want to have one slot.
>     >> I'm fine with that if we want to make that change.
>
>     Nicolas> I don't agree.  The I-D is clear on channel bindings
>     Nicolas> being a single octet string.  The prefix is a US-ASCII
>     Nicolas> string prefixed to the raw channel binding octet string.
>     Nicolas> After the prefix is added you still have a single octet
>     Nicolas> string.
>
> O, I think Simon and I thought it was called a prefix because we
> expected it to be prefixed in a lot of protocols.  I don't read the
> current text that way at all.
>
> I think Simon, Jeff and I would be happy if the draft did actually say
> that.
> Simon, would you be willing to propose a change?

I'm confused by the on-channel-binding document and I'm not convinced
any minor change would have made the document clearer to me.

What I'm looking for is a recipe to reference on-channel-binding in an
authentication protocol like GS2.  GS2 wants to bind authentication to a
secure channel such as TLS.  That seems to be a fairly simple and common
way to use the on-channel-binding document (or?) so the length of this
discussion, and the lack of specific suggestions for GS2, suggest to me
that something is missing from the channel binding document.

What I'm looking for is something like this:

  X. Requirements On Frameworks That Use Channel Bindings

  Frameworks that wish to utilize a channel binding mechanism by
  referencing this document MUST transfer both the channel binding name
  (the unique prefix) and the channel binding data.  This MAY be done by
  concatenating the two strings.

/Simon

_______________________________________________
CHANNEL-BINDING mailing list
CHANNEL-BINDING@ietf.org
https://www1.ietf.org/mailman/listinfo/channel-binding