RE: [TLS] the use cases for GSS-based TLS and the plea for integrating

[Chris Newman <Chris.Newman at Sun.COM>]

Larry Zhu wrote on 7/26/07 9:31 -0700:
> Chris Newman wrote:
> > TLS only provides certificate-based identity today, a mechanism
> > that is very different from other user identity services because it does not
> > require the TLS stack to perform a user identity network lookup in the middle
> > of the TLS handshake.  Doing that means the TLS stack suddenly has to
> > communicate problems talking to the identity lookup service through the TLS
> > stack and back to the application.
>
> Reading what you are saying, I suspect you have somewhat misunderstood the
> proposal and the GSS-API abstraction in general.

That's entirely possible, which is why I wanted to engage in this debate before 
something arrives in front of the IESG and I have to make a decision.  As 
applications area director, I have to invest time to learn how important 
infrastructure proposals are likely to impact Internet applications in general, 
but I have no illusions of being a security expert (rather I'm an application 
expert with a focus on security technology).  This issue is too important for 
me to decide alone, so I'm asking for help from the community to consider these 
issues.

> Unfortunately I am on my way home. Thanks for the delay in the airport I am
> still phyiscally in Chicago.

I wish you a safe flight home.  FYI, I very much appreciate your participation 
in the IETF process.  Technical debate is messy but when the parties involved 
all want the best possible outcome for the Internet, it is worth the effort.

I do want to see Kerberos, TLS and applications such as HTTP, SMTP, IMAP, POP 
combined in a way that is most likely to be widely deployed by multiple vendors.

> I would suggest for you to talk with Sam Hartman

I will certainly do that.  However, I recommend you talk to application 
developers who consume TLS and GSSAPI/SSPI/SASL/EAP APIs to see how they feel 
about these issues.

               - Chris


_______________________________________________
TLS mailing list
TLS at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/tls