Re: Security Considerations

[Eric Rescorla <ekr@xxxxxxxxxxxxxxxxxxxx>]

Apparently I wasn't clear. I meant what if my implementation *only* supports
my new mechanism. I.e., I couldn't interoperate securely with someone who
did Basic/TLS.

-Ekr

James M Snell <jasnell@xxxxxxxxx> wrote:
> Robert likely has his own opinions on this question, but so long as
> implementations were capable of being extended/configured to support the
> new mechanism, yes. The problem is really not that different from any
> other extensibility problem.
> 
> - James
> 
> Eric Rescorla wrote:
> > [snip]
> > So, I'm not sure what this text is supposed to mean.
> > 
> > Let's try working by example: if I defined a new (stipulated secure)
> > challenge-response mechanism based on GMAC and used that as my
> > authentication mechanism, would you consider my implementation
> > conformant?
> > 
> > -Ekr
> > 
> >