Re: [kitten] [Ietf-krb-wg] Channel bindings -- interop issue with GSS_C_AF_*

[Nico Williams <[e-mail]>]

On Tue, Jun 7, 2011 at 11:44 AM, Martin Rex <[e-mail]> wrote:
> Thomas Maslen wrote:
>>
>> and the general opinion seemed to be that the issue is moot because
>> addresses in channel bindings were a mistake and these days you should
>> pretty much always be using addressless channel bindings.
>
> This matches my personal opinion about address-based channel bindings.
> They would intefere with firewall traversal, NAT-traversal and any
> kind of application-level backend-internal load-balancing and
> communication forwarding at protocol levels below GSS-API.

Correct.

>> In an addressless channel binding, what is the correct address-type
>> value to use?  Is it 0 (GSS_C_AF_UNSPEC), or is it 255 (GSS_C_AF_NULLADDR)?
>
> I'm confused.  An application that doesn't want address-based channel
> bindings would likely supply GSS_C_NO_CHANNEL_BINDINGS.  Mine does.

You forget about the "application_data" field, which is where we put
the TLS (or whatever) channel bindings data.

See RFCs 5056 and 5554.  Oddly enough, I don't think we ever specified
which GSS_C_AF_* to use.  I think the right answer is: memset() the
gss_channel_bindings_struct to zero, then set the application_data
field.  In other words, GSS_C_AF_UNSPEC.

Dear KITTEN WG: do we have to update RFC5554 about this??  Or should
we file an erratum?

Nico
--