Re: KITTEN: IETF 75 - 76

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Wed, Aug 19, 2009 at 09:58:58PM +0200, Martin Rex wrote:
> Nicolas Williams wrote:
> > 
> > > I'm not worried about rekeying, if you want to tackle that we are  
> > > redoing the whole gss-api model.
> > 
> > Not really.  The SSPI does it, and the SSPI is very similar to the
> > GSS-API.  Re-keying would be an incremental change, not a fundamental
> > one (but it would require updates to app protocols in order for them to
> > be able to use it).  For SASL re-keying would be much more intrusive .
> > No, I don't care about re-keying.
> 
> Re-keying will require re-design of the API.

I don't agree.  It should be an incremental change to the API, though
requiring changes to app protocols.

> I'm not aware about rekeying being available in SSPI.

It is, when used for TLS.

> In traditional GSS-API it is not possible to modify a security
> context once it has been established.  And a communication might

That's not a problem.

> go entirely unidirectional after security context establishment
> for the rest of its lifetime (e.g. the data channel of an FTP
> with GSS-API extensions).

That's an app protocol problem (see previous caveats that re-keying
_obviously_ would require app protocol changes).