Re: [kitten] SASL, how to choose the type of channel binding?

[Dave Cridland <[e-mail]>]

On Tue, 21 Apr 2020 at 22:33, Simon Josefsson <simon=
[e-mail]> wrote:

> Rick van Rein <[e-mail]> writes:
>
> > Hello,
> >
> > I can see that the GS2 negotiates *whether* to use channel binding, but
> > how can a client and server agree on *which* form to use?
>
> Practically it is hard-coded to 'tls-unique' that, alas, has security
> issues.  See RFC 7627.  GS2 does not provide any facility to (reliably)
> negotiate which channel binding type to use, that negotiation has to
> come from the SASL application protocol or out-of-band.  See section 5.2
> of the document.  I don't recall any SASL application protocols that
> provide this feature -- does anyone know of any example?
>

No, but the XMPP community uses channel bindings quite heavily (or at
least, more so than anywhere else I've noticed).

If you feel like throwing a XEP (or an I-D) toward the XSF on negotiation
of channel bindings (should be a simple stream feature), you might find
some interest there.

Dave.