[TLS] RE: Review of draft-santesson-tls-gssapi-00

[<Pasi.Eronen at nokia.com>]

Simon Josefsson wrote:

> > I'm not sure if we really need special GSSAPI ciphersuites either...
> > But at least it would allow the client to say "I want to do
> > RSA+GSS-API, not plain RSA" in a way that would be correctly
> > understood by existing servers (that don't do GSS-API).
> 
> Ok.  I believe it would be a considerable advantage to avoid 
> requiring new ciphersuites for GSS-API negotiation.

BTW, I'd be interested to know why, and what you consider
to be the advantages? 

<snip>
> When GSS-API mechanisms are used in protected channels (such as 
> TLS, possibly using a double-handshake mechanism together with 
> channel bindings in the authentication) I don't see any 
> cryptographic need for the authentication mechanism to also 
> provide message security services.  Designing messages security 
> services is quite complicated, so if possible I would want to 
> avoid it.

So would your suggestion be to use the GSS-API channel binding
(in GSS_Init/Accept_sec_context) instead of GSS_GetMIC/GSS_Wrap? 

Is there any danger that this could allow replaying GSS tokens
from a different context where the acceptor ignores the channel 
bindings (see RFC 4121, Section 7)? Or can this be addressed
by some other means?

Best regards,
Pasi

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls