Re: [TLS] Review of draft-santesson-tls-gssapi-00

[EKR <ekr at networkresonance.com>]

Stefan Santesson <stefans at microsoft.com> writes:
> If the TLS state machine still have control over the security level of the encryption key, would it still be a problem that several roundtrips is required for the GSS exchange?

Yes.


> If so, why is this a problem, except from an emotional purity perspective.

I'm not sure how to explain it any better than I have already. TLS
has a state machine with a given number of round trips. You're
proposing to change it into a state machine with an *arbitrary*
numbr of round trips determined not inside TLS but rather coupled
with the GSS state machine. That's a radical change and strikes
me as extremely hard to analyze.

-Ekr

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls