Re: [kitten] Fw: New Version Notification for draft-mills-kitten-sasl-oauth-02

[Nico Williams <[e-mail]>]

On Fri, Apr 8, 2011 at 12:31 PM, William J. Mills <[e-mail]> wrote:
> At the moment I was going with simple.  If multiple types are supported then
> I have to be able to communicate what types of channel binding are accepted,
> which I suppose could go in the WWW-Authenticate header in the discovery
> information.  It's relatively easy to add a variable for the CB type.
> If tls-server-end-point is easier to implement I'm happy to pick that one,
> subject to limiting to a single CB type.

Not caring about CB type is simple.  Checking the CB type is not
simple, particularly since the mechanism can't really know what CB
type is being used.  Yes, RFC5056 says apps should prefix the CB data
with the type name, but that's NOT something that a mechanism should
ever rely on.

> My thought was that if the service is offered over another secure channel
> then OAUTH-SSH could be defined for channel binding to SSH.

The mechanism should not care what type of CB data is being used.  The
mechanism should limit itself to ensuring that the CB data are the
same on the initiator and acceptor sides of a security context
establishment -- that's all the mech should do.

Nico
--