IETF Logo Mail Archive

Re: [TLS] the use cases for GSS-based TLS and the plea for integrating

Leif Johansson <leifj@it.su.se> Thu, 26 July 2007 20:00 UTC

Return-path: <tls-bounces@lists.ietf.org>
Received: from [127.0.0.1] (helo=stiedprmman1.va.neustar.com) by megatron.ietf.org with esmtp (Exim 4.43) id 1IE9VM-00074i-2F; Thu, 26 Jul 2007 16:00:12 -0400
Received: from [10.90.34.44] (helo=chiedprmail1.ietf.org) by megatron.ietf.org with esmtp (Exim 4.43) id 1IE9VK-00071w-4U for tls@ietf.org; Thu, 26 Jul 2007 16:00:10 -0400
Received: from smtp3.su.se ([130.237.93.228]) by chiedprmail1.ietf.org with esmtp (Exim 4.43) id 1IE9VJ-0006lC-Oo for tls@ietf.org; Thu, 26 Jul 2007 16:00:10 -0400
Received: from localhost (localhost [127.0.0.1]) by smtp3.su.se (Postfix) with ESMTP id 85DD33BE8D; Thu, 26 Jul 2007 22:00:08 +0200 (CEST)
Received: from smtp3.su.se ([127.0.0.1]) by localhost (smtp3.su.se [127.0.0.1]) (amavisd-new, port 10024) with LMTP id 28552-03-14; Thu, 26 Jul 2007 22:00:08 +0200 (CEST)
Received: from [130.129.18.102] (dhcp-1266.ietf69.org [130.129.18.102]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp3.su.se (Postfix) with ESMTP id 6AD5E3BE67; Thu, 26 Jul 2007 22:00:07 +0200 (CEST)
Message-ID: <46A8FD4F.7050203@it.su.se>
Date: Thu, 26 Jul 2007 22:00:15 +0200
From: Leif Johansson <leifj@it.su.se>
User-Agent: Thunderbird 1.5.0.12 (X11/20070604)
MIME-Version: 1.0
To: Chris Newman <Chris.Newman@Sun.COM>
Subject: Re: [TLS] the use cases for GSS-based TLS and the plea for integrating
References: <200707171840.l6HIeg9M018099@fs4113.wdf.sap.corp> <48A6320349FD1EDBE937A357@dhcp-26f9.ietf69.org> <C4E819FF73EA6ED22A3906CD@446E7922C82D299DB29D899F>
In-Reply-To: <C4E819FF73EA6ED22A3906CD@446E7922C82D299DB29D899F>
X-Enigmail-Version: 0.94.2.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7bit
X-Virus-Scanned: by amavisd-new at smtp.su.se
X-Spam-Status: No, hits=-1.951 tagged_above=-99 required=7 tests=[AWL=0.361, BAYES_00=-2.312]
X-Spam-Level:
X-Spam-Score: 0.0 (/)
X-Scan-Signature: 79899194edc4f33a41f49410777972f8
Cc: tls@ietf.org
X-BeenThere: tls@lists.ietf.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.lists.ietf.org>
List-Unsubscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=unsubscribe>
List-Archive: <http://www1.ietf.org/pipermail/tls>
List-Post: <mailto:tls@lists.ietf.org>
List-Help: <mailto:tls-request@lists.ietf.org?subject=help>
List-Subscribe: <https://www1.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@lists.ietf.org?subject=subscribe>
Errors-To: tls-bounces@lists.ietf.org

>
> I'd agree that implementers only want to integrate one security
> services layer. But some implementers want their security services
> layer and identity stack to be as cleanly separated as possible so a
> tight binding between the two is not desirable.  TLS only provides
> certificate-based identity today, a mechanism that is very different
> from other user identity services because it does not require the TLS
> stack to perform a user identity network lookup in the middle of the
> TLS handshake.  Doing that means the TLS stack suddenly has to
> communicate problems talking to the identity lookup service through
> the TLS stack and back to the application.
>
Username+password has the same property right? Would you support a
password-based
scheme inside TLS or would you support removing authentication from TLS
entierly?

    Cheers Leif


_______________________________________________
TLS mailing list
TLS@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls

v2.46.0 | Report a Bug | By Email | System Status