Re: [I-D ACTION:draft-ietf-nfsv4-channel-bindings-00.txt]

On Thu, Oct 30, 2003 at 02:43:08PM -0500, Linn, John wrote:
> I've now read channel-bindings-00, and believe that it offers a valuable
> result in two ways: by clarifying concepts of channel bindings (which have
> long been one of the less well-understood aspects of GSS-API) and by
> defining useful concrete facilities layered on the construct.  I'd encourage
> others to review and comment as well; in particular, the details of linkages
> to particular protocols should be evaluated by the experts and WGs involved
> with those protocols.

Great.

> One question: can the pseudo-mechanisms as discussed in Sec. 3.1 be used in
> conjunction with SPNEGO-style negotiation, or are these types of
> pseudo-mechanisms mutually exclusive?

I was hoping to cross this bridge when I came to it.

If no SPNEGO apps have ever used channel bindings (and I'm quite sure
that that is indeed the case), then we could update the SPNEGO spec to
say that SPNEGO only passes channel bindings to mechanisms like CCM-* or
which otherwise explicitly require the use of channel bindings and that
applications that use SPNEGO MUST check the actual mech output parameter
of GSS_Init/Accept_sec_context() to determine whether channel bindings
were used.

Cheers,

Nico
-- 
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email protected]