Re: [TLS] Negotiation in draft-santesson-tls-gssapi

[Nicolas Williams <Nicolas.Williams at sun.com>]

On Thu, Jul 19, 2007 at 05:49:41AM +0200, Martin Rex wrote:
> I notice, however, that I still consider the necessary contortions
> to run the entire GSS-API context establishment within TLS and
> the TLS handshake according to the current ID _MAGNITUDES_ worse
> if one also wants to make use of all the various GSS-API
> features and extensions.

One should not.  This I-D is roughly akin to RFC4462 (SSHv2 w/ GSS).

> For cached&resumed SSL sessions, there are no additonal roundtrips
> in either case (just the unexplained dirty hacks for the current ID
> in order to get access to GSS-API attributes of the original
> full SSL handshake).

Correct.

> Personally, I do not consider the additional roundtrips of the
> GSS-API context establishment a showstopper.  The overhead of

Me either.  But that's not what Larry meant, I think.  See my other
reply just now.

Nico
-- 

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls