Re: Last Call: 'The Kerberos V5 ("GSSAPI") SASL mechanism' to Proposed Standard (draft-ietf-sasl-gssapi)

On Mon, Aug 28, 2006 at 01:39:42PM -0700, Mark Crispin wrote:
> 
> I request consideration of the following changes prior to publication.
> 
> Page 4, first paragraph, please change:
>    [...]  When calling the GSS_Init_sec_context the client
>    MUST pass the integ_req_flag of TRUE.
> to
>    [...]  When calling the GSS_Init_sec_context the client
>    SHOULD pass the integ_req_flag of TRUE.
> 
> Otherwise, publication of this document would have the effect of declaring 
> existing deployed software to be non-compliant.  I agree that this change 
> is desirable, but I disagree about retroactively declaring existing 
> software broken.  If the WG feels strongly enough, it'd be alright to have 
> something in the security considerations saying that earlier versions did 
> not require the integ_req_flag, but all new implementations ought to have 
> it and old implementations fixed.

Since this is all specific to the Kerberos V GSS-API mechanism I think
the value of this flag is irrelevant, so this change should not render
any earlier implementations non-compliant in terms of their on-the-wire
behaviour.

(At least one implementation of the Kerberos V GSS mechanism used to
leave out confidentiality protection, but none, to my knowledge, fails
to provide MIC and/or wrap tokens when integ_req_flag == false in the
call to GSS_Init_sec_context().)

> Suggested changes (this is just cosmetic):
> 
> Page 5, second paragraph, change
>    [...] chan_binding of NULL
> to:
>    [...] chan_binding of GSS_C_NO_CHANNEL_BINDINGS
> 
> Similarly for page 7 in the third paragraph of the Security 
> Considerations.

GSS_C_NO_CHANNEL_BINDINGS is only defined in the C bindings of the
GSS-API (RFC2744), whereas the base GSS-API specification (RFC2743) uses
"NULL" to mean "no channel bindings" (e.g., "...where NULL channel
bindings..." and "[w]hen non-NULL channel bindings are provided").

Nico
-- 

_______________________________________________
Kitten mailing list
Kitten@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten