Re: Please review: http gss authentication mech

[Leif Johansson <leifj at it.su.se>]

Michael B Allen wrote:
> I don't speak for kitten and I'm not familiar with the TLS channel binding
> thing but the only flaw in the Negotiate method that really that really
> jumps out is the conflict between stateful GSSAPI and stateless HTTP. How
> does your method address this issue?
>
>   
If I understand your question correctly the gss draft aims to solve this
problem by having the
server send state back to the client (state which is also used to do
fast reauth) with the challenge.
There are several ways to implement this, including short-cuts if you
use kerberos and proposed
extensions to allow exporting unfinished contexts from gssapi.

    Cheers Leif

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten