Re: Please consider forward motion on PRF and mechanism attributes

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Mon, Apr 11, 2005 at 05:51:14PM -0500, Nicolas Williams wrote:
> On Mon, Apr 11, 2005 at 06:21:24PM -0400, Sam Hartman wrote:
> > 
> > 
> > Hi.  I'd like to ask the working group to consider trying to move
> > forward the PRF drafts rapidly.  In addition, while I don't think we
> > are close to being in a position to know what mechanism attributes we
> > want, I'd love to have consensus on the APIs for accessing mechanism
> > attributes.
> > 
> > Having forward progress on these items may end up helping a proposal
> > Joe Salowey is working on.
> 
> As far as I'm concerned the I-Ds are ready for WG LC.
> 
> That said, we may want to remove the restriction that the krb5 GSS_Prf()
> cannot be ready prior to full context establishment.  Applications that
> use GSS_Prf() can certainly ensure that they call it in synchronized
> fashion before OR after full context establishment.  I mention this ONLY
> as a result of your other post today about negotiation and composite
> mechanisms -- having GSS_Prf() prior to full context establishment could
> help construct stackable pseudo-mechanisms that protect against
> manipulation of its context tokens into those of underlying mechanisms'.

Er, disregard that suggestion -- there's never a partially established
security context for the Kerbers V GSS mechanism on the acceptor side...

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten