Re: Determining strength of encryption provided by a GSS-API mechanism

[Nicolas Williams <Nicolas.Williams at sun.com>]

> 	gss_buffer_t	context_establishement_policy,
> 	gss_buffer_t	per_msg_token_policy

These buffers would have policy names, in the caller's locale's codeset,
or maybe just all US-ASCII.  We'd also need a function to get localized
policy names (and descriptions).  And we'd need a namespace for
standards-based policy names vs. local policy names.  Plus a policy
comparison function.

OM_uint32
gss_display_policy(
	OM_uint32	*minor_status,
	gss_buffer_t	policy,
	gss_buffer_t	localized_name,
	gss_buffer_t	localized_desc,
	int		*is_context_establishement_policy,
	int		*is_per_msg_token_policy
);

A function for listing known policies would also be nice.  The contents
of policies would be purely local; no interchange format is needed.

/*
 * 'result' is set to 1 if policy1 is a superset of policy2, 0 if the
 * two policies are equivalent, and -1 if they are disjoint or if
 * policy2 is a superset of policy1.
 *
 * If mech is GSS_NO_OID then the comparison is across all available
 * mechanisms.  (Internally the framework would call the
 * compare_policies method for each available mechanism, and set result
 * to 1 or 0 only if all the comparisons output the same non-negative
 * value, else -1.)
 */
OM_uint32
gss_compare_policies(
	OM_uint32	*minor_status,
	gss_OID		mech, /* may be GSS_NO_OID */
	gss_buffer_t	policy1,
	gss_buffer_t	policy2,
	int		*result
);