[CHANNEL-BINDING] Re: draft-ietf-sasl-gs2 AD review comments

Sam Hartman <hartmans-ietf@mit.edu> writes:

>>>>>> "Simon" == Simon Josefsson <simon@josefsson.org> writes:
>
>     Simon> Sam Hartman <hartmans-ietf@mit.edu> writes:
>     >> The draft looks quite good, but there are a few things that
>     >> need to be resolved before I can last call it.
>
>     Simon> Thanks for your review!
>
> Your proposed fixes look good except for the following:
>     >> It also appears to violate the requirement that the name of the
>     >> channel type be used in the channel binding data.
>
>     Simon> I believe you are referring to this requirement:
>
>     Simon>       * The name of the type of channel binding MUST be
>     Simon> used by the application and/or authentication protocol to
>     Simon> avoid ambiguity about which of several possible types of
>     Simon> channels is being bound.  If nested instances of the same
>     Simon> type of channel are available then the innermost channel
>     Simon> MUST be used.
>
>     Simon> I thought that channel binding data had to contain a unique
>     Simon> prefix which would appears to solve that problem, without
>     Simon> having to require that protocols encode the channel binding
>     Simon> type too.  If my assumption is correct, it would be useful
>     Simon> to clarify this in d-w-on-channel-binding.  No change in
>     Simon> GS2 seems necessary.  Nico?
>
> I thought it was the responsibility of the application|framework to
> add the unique prefix.  The channel binding base draft provides a
> registry for this prefix, but I thought that the channel binding
> description did not include this prefix and left it up to the
> application.  If the channel binding format must include the prefix
> then I think we need to change the channel binding base draft.
>
> Comments?

It appears simpler to me if channel binding data would always contain
the unique prefix, properly delimited.

Otherwise each protocol using channel binding need to have one slot for
the "name of the type of channel binding" and one for the channel
binding data.  That is difficult to do properly if there are no guidance
on the properties of these fields in williams-on-channel-binding.  It is
not clear to me what "name of the type of channel binding" refers to.
Is it the unique prefix?  Or the binding type?  Or the channel type?
All three fields are present in the channel binding IANA section.

For example, would concatenating the unique prefix with channel binding
data be sufficient?  How can unique prefixes look like, [a-zA-Z0-9]?  I
couldn't find anything in williams-on-channel-binding that discuss this.

/Simon

_______________________________________________
CHANNEL-BINDING mailing list
CHANNEL-BINDING@ietf.org
https://www1.ietf.org/mailman/listinfo/channel-binding