Re: [TLS] Review of draft-santesson-tls-gssapi-00

[Jeffrey Altman <jaltman at secure-endpoints.com>]

Martin Rex wrote:
> Making it easy or encouraging people to configure future Web-Servers
> with TLS_GSSAPI only ciphersuites is equal to dropping
> mandatory to implement ciphersuites and traditional strong interoperability
> of TLS will be lost forever.
The sites that have deployed RFC 2712 do not have certificates today and
they want to force users to authenticate using there existing Kerberos
infrastructure.  Forcing the deployment of a certificate in order to
deploy TLS_GSS is not going to alter the behavior of the administrators
who insist that only Kerberos mutual authentication be used.

Please remember that mandatory to implement does not mean mandatory to
deploy.    There is nothing preventing the deployment of a server that
supports both TLS_GSS and certificate based ciphers that are used in
most public settings.   Adding complexity to the deployment of TLS_GSS
is not going to alter the deployment policies of the administrators who
use it.

Jeffrey Altman

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls