Re: [SPKM] Re: FW: I-D ACTION:draft-zhu-pku2u-01.txt

Nicolas Williams wrote:
> 
> On Thu, Apr 19, 2007 at 04:16:16PM +0200, Martin Rex wrote:
> > Nicolas Williams wrote:
> > > I can't tell if RFC2478/4178 require that header on non-initial SPNEGO
> > > context tokens, but our implementation does NOT put it on any SPNEGO
> > > context token other than the initial one.  Did we miss this?
> > 
> > > 
> > > This requirement, if we wanted to make it, would have to apply only to
> > > future Standards-Track mechs.
> > 
> > That requirement *DID* exist in rfc-2478.  So there seems to be
> > a completely backwards incompatible change in rfc-4178.
> > At least rfc-4178 is very explicit what it wants in 4.2.
> > 
 [...]
> > I thought there was an interop of SPNEGO-implementations a while ago--
> > I would have expected this issue to become apparent if it was ambiguous,
> > provided that there are truely independent implementations of _the_spec_.
> 
> There truly independent implementations of _RFC4178_ were tested.

As I said, rfc-4178 is very explicit what it wants in section 4.2.
and this fact is highly appreciated.

I would have expected this backwards incompatible change to become
apparent when interop-testing backwards compatibility with exiting
(i.e. legacy) implementations of SPNEGO.  SPNEGO started out as SNEGO (without
the handshake protection and without the optimistic token), and
IIRC there (once) was a sample implementation of SNEGO by Bull
announced by Denis Pinkas:

  From: pinkas@emsc.frcl.bull.fr (Denis Pinkas)
  Message-Id: <9602271637.AA23945@emsc.frcl.bull.fr>
  Subject: Simple GSS-API negotiation available
  To: cat-ietf@mit.edu (IETF CAT WG)
  Date: Tue, 27 Feb 1996 17:37:43 +0100 (NFT)

  An implementation of the Simple GSS-API negotiation mechanism
  (Internet-Draft draft-ietf-cat-snego-01.txt, 19 February 1996)
  is now available at the following URL :

      ftp://ftp.enst-bretagne.fr/pub/security/gssneg.tar.gz

  It uses SNACC 1.1 libraries for encoding and decoding of PDUs
  described in ASN.1. The SNACC compiler can be found at:

Unfortunately, that "reference" implementation appears to be
no longer available anywhere.

Anyway -- there seemed to be very few independent implementations
of rfc-2478 and only one implementation with a significant installed
base.  Personally, I never liked SPNEGO, and the claimed abiguities
in rfc-2748 seemed to cause a certain amount of interoperability
problems anyway, so I think it is OK if rfc-4178 prefers interoperability
with a significant installed base to interoperability with rfc-2478.

When a feature of a revised spec is significantly clarified over the
previous version of the spec, a backwards interoperability warning
should be added.  This is missing in rfc-4178 4.2.

-Martin

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm