Re: [xmpp] DNA transport

That's a good point -- looking more closely at the spec, the current  
format only carries one authorization (AC or SAML).  However, it would  
be easy to extend it to support multiple authorizations; I don't see  
any obvious length constraints.  How many authorizations are we  
talking about?

--Richard

On Jan 15, 2010, at 12:41 PM, Stephen Farrell wrote:

>
> Richard L. Barnes wrote:
>> Assuming for the moment that we're going to stick with attribute  
>> certs:
>> Rather than using both TLS and some new XML to carry DNA information,
>> why not just hand the attribute certs over as part of the TLS
>> negotiation?  That is, carrying XMPP authorization certs seems like a
>> natural application of the TLS authorization extensions [1].  That  
>> way,
>> implementations can save on the crypto costs (since tls-authz is
>> reportedly already implemented in OpenSSL, GNUTLS, and NSS), and
>> draft-ietf-xmpp-dna can focus on the AC profile.
>
> Would tls-authz work for the number of ACs that'd be involved here?
> I understood that there could be a lot, which could therefore be a
> good reason to do DNA at the application layer. Triggering sending
> the right ACs at the right time could also be tricky depending on
> the interfaces between the TLS library and the application. So I'd
> say this is worth checking out, and would be interested if someone
> did that, but I'd be a bit surprised if it were the right answer
> in the end.
>
> S.
>
>
>
>>
>> --Richard
>>
>> [1] <http://tools.ietf.org/html/draft-housley-tls-authz-extns-09>
>>
>> _______________________________________________
>> xmpp mailing list
>> xmpp@ietf.org
>> https://www.ietf.org/mailman/listinfo/xmpp
>>