Re: [xmpp] DNA transport

Richard L. Barnes wrote:
> Assuming for the moment that we're going to stick with attribute certs:
> Rather than using both TLS and some new XML to carry DNA information,
> why not just hand the attribute certs over as part of the TLS
> negotiation?  That is, carrying XMPP authorization certs seems like a
> natural application of the TLS authorization extensions [1].  That way,
> implementations can save on the crypto costs (since tls-authz is
> reportedly already implemented in OpenSSL, GNUTLS, and NSS), and
> draft-ietf-xmpp-dna can focus on the AC profile.

Would tls-authz work for the number of ACs that'd be involved here?
I understood that there could be a lot, which could therefore be a
good reason to do DNA at the application layer. Triggering sending
the right ACs at the right time could also be tricky depending on
the interfaces between the TLS library and the application. So I'd
say this is worth checking out, and would be interested if someone
did that, but I'd be a bit surprised if it were the right answer
in the end.

S.

> 
> --Richard
> 
> [1] <http://tools.ietf.org/html/draft-housley-tls-authz-extns-09>
> 
> _______________________________________________
> xmpp mailing list
> xmpp@ietf.org
> https://www.ietf.org/mailman/listinfo/xmpp
> 