Re: [SPKM] Re: FW: I-D ACTION:draft-zhu-pku2u-01.txt

On Wed, Apr 18, 2007 at 11:03:55PM +0200, Martin Rex wrote:
> > We should probably consider whether we want to RECOMMEND, or even
> > REQUIRE that that header be added to all security context establishment
> > tokens, not just the initial one.
> > 
> > But until somebody tables that matter we should not consider
> > RFC1964/4121 as imposing such a requirement on other mechanism that use
> > different mechanism OIDs.
> 
> Require, because it will amount to less code, less complexity and less
> confusion.  The overhead is negligable.  I don't expect any implementation
> of PKU2U to NOT provide rfc1964/rfc4121 functionality as well, despite
> the seperate mechanism OID.

I can't tell if RFC2478/4178 require that header on non-initial SPNEGO
context tokens, but our implementation does NOT put it on any SPNEGO
context token other than the initial one.  Did we miss this?

This requirement, if we wanted to make it, would have to apply only to
future Standards-Track mechs.

> > That said, there's this interesting question: PKU2U re-uses RFC4121 for
> > everything following PKU2U's first two security context tokens (which
> > are KDC messages between the initiator and the acceptor acting as a
> > pseudo-KDC), so, should those context tokens lifted from RFC4121 bear
> > this header?
> 
> I really want to see the generic framing on all context level tokens
> (which is what you meant by header, I assume).

Yes, that's what I meant by 'header'.

> Could it be that you actually didn't want to ask about the framing,
> but about the mechanism OID within the header (if it is present)?

No.

> I'd like to see the generic framing, and I'd like to see it with
> the same mechanism OID as in the initial context token (which is
> different from rfc1964/rfc2141).

Yes, if the generic header is on all context tokens then the same OID
has to be used for all those context tokens for any given security
context.

Nico
-- 

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm