Re: KITTEN: IETF 75 - 76

[Martin Rex <[e-mail]>]

Nicolas Williams wrote:
> 
> > I'm not worried about rekeying, if you want to tackle that we are  
> > redoing the whole gss-api model.
> 
> Not really.  The SSPI does it, and the SSPI is very similar to the
> GSS-API.  Re-keying would be an incremental change, not a fundamental
> one (but it would require updates to app protocols in order for them to
> be able to use it).  For SASL re-keying would be much more intrusive .
> No, I don't care about re-keying.

Re-keying will require re-design of the API.

I'm not aware about rekeying being available in SSPI.

It must be availabe in some way for schannel, because IIS is
able to perform renegotiation in order to request a client cert
after having looked at the URL -- but I do not think it exists
for NTLM or Kerberos 5 SSPs.  If I'm wrong, do you have an URL
to the Microsoft documentation describing how it works?


In traditional GSS-API it is not possible to modify a security
context once it has been established.  And a communication might
go entirely unidirectional after security context establishment
for the rest of its lifetime (e.g. the data channel of an FTP
with GSS-API extensions).


-Martin