Re: [TLS] the use cases for GSS-based TLS and the plea for

[Martin Rex <Martin.Rex at sap.com>]

Kemp, David P. wrote:
> 
> It seems strange to criticize SPKM and SPNEGO for being ASN.1-based
> while not making the same criticism of Kerberos.   To what extent
> has the adoption and theoretical review of Kerberos been hampered
> by this "huge" roadblock?

When ASN.1 was less of a problem, then the ambiguity about
the AlgOID within PKCS#1 would not have been earlier detected,
it would not even exist!

Or you may want to look at the pity the PKI guys created with
certificate chains in ASN.1 containers (SOAP/WS-Security).
The PKI guys messed abused PKCS#7 containers and CertificatePairs
until they finally came up with a PKIPath.

The text of the defect report describing PKIPath (not easy to find)
is much better than what was added to the spec document.  But
both do not say a word whether a self-signed RootCA certs is
either prohibited, allowed, expected, required.  TLSv1.0
already recognized this ambiguity in SSLv3 and fixed it long ago.


-Martin

_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls