Re: [TLS] Negotiation in draft-santesson-tls-gssapi

[Nicolas Williams <Nicolas.Williams at sun.com>]

I just noticed Martin's objection that mechanism negotiation must be
done at the TLS level to avoid a failure mode where GSS is selected but
no common mechanism is found, yet non-GSS/PSK TLS would have worked.

The current version of the I-D allows TLS to continue to make progress
if the GSS security context establishment fails.  This is good, but if
negotiation could be done at the TLS level then we can optimize
round-trips in this corner case.  I'm not sure if we care.

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls