Re: gs2 hashed oids

[Jeffrey Hutzelman <[e-mail]>]

--On Thursday, January 08, 2009 02:39:34 PM +0100 Arnt Gulbrandsen 
<[e-mail]> wrote:

>
> Jeffrey Hutzelman writes:
>> Stackable pseudo-mechanisms are not the same as multi-level negotiation.
>> Multi-level negotiation is a problem because you end up having to
>> agree on one level before knowing if there's a mutually-acceptable
>> mechanism at the next.  But stackable mechanisms don't work that way;
>> every possible stack has an OID, composed from the OID's of the
>> stacked mechanisms (see section 4.1 of
>> draft-ietf-kitten-stackable-pseudo-mechs-02.txt).  Then the entire
>> _stack_ is negotiated at once, as if it were a single mechanism.
>> This leads to an explosion of possible mechanism OID's, where it's
>> not entirely possible to predict what they all are, but is entirely
>> unreasonable to expect every combination to be named and registered.
>
> It sounds as though a server asked to use GS2-GQGFDSAGDSAF would have to
> recurse through all possible mechanism stack

Yes, but the SASL and GS2 implementation need not worry about this; all 
they should need to do is call GSS_Indicate_mechs(), whose result will 
include any composite mechanisms which are part of the default set.  Or, it 
may use GSS_Indicate_mechs_by_mech_attrs() to list mechanisms (including 
composite mechanisms) which have the attributes GS2 requires.

-- Jeff