RE: [SECMECH] Generally usable mechanism requirements

Thanks Clint, 

<snip>
> > 4. MUST support key derivation based on the authentication. 
>  This is 
> > the way EAP establishes and a cryptographic context.  GSS-API is 
> > working on a standard PRF API to expose this functionality 
> in GSSAPI mechanisms.
> 
> "EAP establishes and a cryptographic context."  Either 
> something is missing, or something is extra.  I couldn't 
> figure out which.
> 
[Joe] I originally intended it to read "EAP establishes and exports a
cryptographic context."

> 
> > 
> > 5. MUST support a security layer.  This is a requirement of 
> SASL and 
> > GSS-API mechanisms.  GSS-API wrap and mic style protection 
> should be 
> > provided.  Although this is not part of the definition of an EAP 
> > mechanism it should be difficult to add since EAP provides key 
> > material which can be used as a basis for cryptographic 
> functions.  A 
> > generic protection transform can be provided for mechanisms 
> that don't 
> > provide their own.
> 
> "it should be difficult to add since EAP"  Surely this is "it 
> shouldn't be difficult to add since EAP" (and don't call me Shirley)
> 

[Joe] Yes.

> > 9. MUST provide documentation to describe the mechanism properties 
> > defined in [RFC3748]. GUAM mechanisms MUST support the following:
> > generation of keying material, mutual authentication, shared state 
> > equivalence, replay protection, integrity protection, cryptographic 
> > binding, session independence, and ciphersuite negotiation 
> protection.
> > GUAM mechanisms MAY support the following: It is also desirable for 
> > GUAM mechanisms to support the following: resistance to dictionary 
> > attacks, fragmentation, and confidentiality.
> 
> 
> "GUAM mechanisms MAY support the following: It is also 
> desirable for GUAM mechanisms to support the following: 
> resistance to dictionary attacks,  fragmentation, and 
> confidentiality."  I think perhaps two thought collided in 
> the above sentence, and infortunately both won; either that 
> or it's a cut and paste error.
> 

[Joe] It should read "GUAM mechanisms MAY support the following:
resistance to dictionary attacks, fragmentation, and confidentiality.

_______________________________________________
SECMECH mailing list
SECMECH@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/secmech