Re: Determining a token's mechanism

[Dennis Glatting <[e-mail]>]

> Date: Tue, 25 Apr 1995 13:20:48 -0400
> From: John Linn <[e-mail]>
> 

> Dennis writes:
> 

> >What value does SPKM_Parse_token() offer the
> >application programmer? How would it be used? 

> 

> Not sure what to say over/above the discussion in Sec. 6 of
> draft-ietf-cat-spkmgss-02.txt.  Do you have areas from
> that section's treatment of usage and rationale in mind
> as needing clarification or improvement? 

> 


That section assumes all tokens are encoded with an OID
and a token type identifier. The GSS-API does not make
that a requirement thereby making the
SPKM_Parse_token()'s utility as a general purpose
GSS-API function dubious. Further,
SPKM_Parse_token()'s function is to aid
demultiplexing tokens which is only useful in a limited
context.    


The function SPKM_Parse_token() is useful if you have a
single context for a given mechanism and are blindly
exchanging tokens after a context is established.
However, many application protocols know what is being
exchanged and how to process the data thereby mitigating
the need to interrogate GSS-API tokens. Further, those
application protocols may have to encapsulate GSS-API
tokens to indicate length. Why not a type indicator too?   


When we look away from mechanism exclusivity and tokens
sent blindly across a connection to multiple mechanism
contexts across one or more connections then the utility
of SPKM_Parse_token() is lost.  


For these reasons I do not believe a GSS-API variant of
SPKM_Parse_token() is useful to the application
programmer. My questions stand.


-dpg