Re: [kitten] comments on draft-ietf-kitten-sasl-saml-ec

[Simo Sorce <[e-mail]>]

On Mon, 2014-03-10 at 14:49 -0400, Sam Hartman wrote:

> Section 5:
> 
> SASL has an idea of mutual authentication.
> It seems like the same checks that apply to GSS-API should apply to SASL
> mutual auth too.
> 
> The checks in section 5 seem inadequate.  In particular, it seems like
> it should matter what identity is used to digitally sign the request,
> and  the validity of the signature should matter.
> 
> >         If the mutual_state flag is not requested, or is not set, then the
> >	    security layer managed by the application outside of the GSS-API
> >	       mechanism is responsible for authenticating the acceptor.  In this
> >	          case, applications MUST match the server identity from the existing
> >		     security layer with the target name.  For TLS, this matching MUST be
> >		        performed as discussed in [RFC6125].  For SSH, this matching MUST be
> >			   performed as discussed in [RFC4462].
> 			   
> 
> This text places normative requirements on applications using this mechanism.
> That's not reasonable because applications may have no knowledge of this mechanism.
> What happens if these checks are not performed?

This text seem to echo Section 4 of RFC 6595 however I see no reference
to 6595 in this draft, maybe I am missing something, this is the first
time I am looking as SASL/SAML drfats, sorry.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York