Re: Impact of a new GSS mech on applications

[Nicolas Williams <[e-mail]>]

On Fri, Mar 20, 2009 at 11:49:17AM +0000, Josh Howlett wrote:
> I understand that a GSS caller can either use a default mechanism, or
> stipulate that a particular mechanism is used.
> 
> From an application's PoV, what are the implications if a new mechanism
> appears on the system?

Acceptor applications are not affected.

For initiator applications:

 - If the application uses a specific mechanism: no impact.

 - If the application negotiates mechanisms: it depends.

   If the new mechanism is anything like SPNEGO, then it's important
   that the application not negotiate it.

   If the new mechanism does not provide per-message tokens but the
   application expects whatever mechanism it negotiates to provide
   per-message tokens then it's important that the application not
   negotiate it.

   Here it'd be useful to have APIs by which to find out about mechanism
   attributes like "is a mechanism-negotiation mechanism like SPNEGO,"
   and "supports wrap tokens" and so on.  In fact, there's an I-D for
   this: draft-ietf-kitten-extended-mech-inquiry-04.txt.

 - If the application uses the default mechanism: it depends on how the
   mechglue selects the default mechanism.

   For example, the Solaris libgss is very dumb about this: it uses the
   first mechanism listed in /etc/gss/mech.

   A better default mechanism selection would be: the first mechanism
   listed in /etc/gss/mech.mechanism listed in /etc/gss/mech for which
   there are initiator credentials.

> For example, it seems to me (speaking from a positive of significant
> ignorance about GSS) that an application might want impose a common
> policy on certain features of GSS-API (anonymity, delegation) across all
> mechanisms. However, it also seems that some mechanism-specific policy
> might be needed (which mechanisms are permitted, quality of protection,
> security services).

Yes.

> I am curious how contemporary applications deal with this.

If they have such needs then they either fail if they negotiate a new
mechanism that does not meet those needs, or they must be updated to
blacklist such new mechanisms.

Thus draft-ietf-kitten-extended-mech-inquiry-04.txt.

Nico
--