Re: [TLS] Review of draft-santesson-tls-gssapi-00

[Martin Rex <martin.rex at sap.com>]

Jeffrey Altman wrote:
> 
> Martin Rex wrote:
> > Making it easy or encouraging people to configure future Web-Servers
> > with TLS_GSSAPI only ciphersuites is equal to dropping
> > mandatory to implement ciphersuites and traditional strong interoperability
> > of TLS will be lost forever.
> The sites that have deployed RFC 2712 do not have certificates today and
> they want to force users to authenticate using there existing Kerberos
> infrastructure.  Forcing the deployment of a certificate in order to
> deploy TLS_GSS is not going to alter the behavior of the administrators
> who insist that only Kerberos mutual authentication be used.
> 
> Please remember that mandatory to implement does not mean mandatory to
> deploy.    There is nothing preventing the deployment of a server that
> supports both TLS_GSS and certificate based ciphers that are used in
> most public settings.   Adding complexity to the deployment of TLS_GSS
> is not going to alter the deployment policies of the administrators who
> use it.

Actually, I would appreciate a (new) requirement that a TLS server
MUST posess at least a self-signed credential for one of the
mandatory-to-implement ciphersuites that include server authentication.

Allowing the admin to disable the ciphersuite is OK, but allowing the
implementation to run without any credential for at least one of
the mandatory-to-implement ciphersuites appears to be a bug in the
interoperability concept behind the mandatory to implement ciphersuites.


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls