Determining strength of encryption provided by a GSS-API mechanism

[Alexey Melnikov <alexey.melnikov at isode.com>]

In continuation of the discussion in Stockholm about what can be done in 
the WG that is of interest to implementors, I have one minor request.

I am working on a Cyrus SASL plugin that either uses GSS-API or SSPI. 
SASL uses a thing called Strength Security Factor (SSF) to determine if 
a particular authentication mechanism is allowed by client or server 
security policy. SSF roughly correspond to the key size for symmetric 
ciphers, with SSF==0 being no privacy and no integrity, and SSF==1 being 
integrity only. (I am not going to defend the concept of SSF, but I 
think it is relatively easy to understand by sysadmins and it seems to 
work.) Each Cyrus SASL plugin needs to advertise its minimal and maximal 
supported SSF, so the maximal SSF is going to be the strength of the 
strongest supported symmetric cipher.

What I am missing is some API for retrieving SSF provided by a GSS-API 
mechanism's gss_wrap() with privacy, as well as for retrieving the best 
SSF that can be provided by the mechanism. Is such API already 
available, and if the answer is no, are people interested in working on 
defining it?

Thanks,
Alexey