Re: WG Last Call: draft-ietf-sasl-gs2-02.txt

[Simon Josefsson <jas@xxxxxxxxxxx>]

Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:

> On Mon, Sep 04, 2006 at 06:35:47PM +0100, Alexey Melnikov wrote:
>> Simon Josefsson wrote:
>> >Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:
>> > <t>This document describes how to use a Generic Security Service
>> >   Application Program Interface (GSS-API) mechanism in the the
>> >   Simple Authentication and Security Layer (SASL) framework.  This
>> >   is done by defining a new SASL mechanism family, called GS2.  The
>> >   mechanism family uses the SASL mechanism negotiation to select the
>> >   GSS-API mechanism, offers reduced number of round-trips over the
>> >   earlier Kerberos V5-specific "GSS-API"
>> >
>> If you are referencing the GS1, why do you have "-"? If not, why is it 
>> quoted?
>
> Yeah, be very carefule with "GSSAPI" vs. "GSS-API" -- in the context of
> SASL the first means "the mistake that was made years ago when the name
> given the SASL mechanism corresponding to the GSS-API Kerberos V
> mechanism was "GSSAPI" and the latter means _the_ GSS-API (as in
> RFC2743).

The intention was to avoid confusion by spelling out "Kerberos
V5-specific" explicitly, but it seems that it didn't succeed.

> Also, there is no SASL mechanism negotiation as such -- SASL
> applications negotiate mechanisms on an ad-hoc basis (each app protocol
> specifies its own negotiations, usually based on the server listing its
> available mechanisms to the client prior to starting SASL).

Right.

> So the the third sentence above needs to be re-written.  I propose:
>
>    This mechanism family offers a number of improvements over the
>    previous SASL/GSS-API mechanism family: it is more general, uses
>    fewer messages for the authentication phase in some cases, and
>    supports a SASL-specific notion of channel binding.

There is no previous SASL/GSS-API mechanism family (the "GSSAPI" mech
isn't a mechanism family, in the RFC 4422 terminology), so I changed
the abstract into:

  <t>This document describes how to use a Generic Security Service
    Application Program Interface (GSS-API) mechanism in the the
    Simple Authentication and Security Layer (SASL) framework.  This
    is done by defining a new SASL mechanism family, called GS2.  This
    mechanism family offers a number of improvements over the previous
    SASL/GSS-API mechanism: it is more general, uses fewer messages
    for the authentication phase in some cases, and supports a
    SASL-specific notion of channel binding.</t>

Thanks,
Simon