Re: WG Last Call: draft-ietf-sasl-gs2-02.txt

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Wed, Sep 06, 2006 at 10:55:35AM +0200, Simon Josefsson wrote:
> For interoperability, I believe this problem should be noted, because
> it may make it impossible to use a negotiated security layer.
> 
> Can we use the following and move on?
> 
>       <t>The "client_maxbuf" field indicate the maximum protected
> 	buffer size the client can receive.  It MUST be 0 if the
> 	client doesn't advertise support for any security layer, the
> 	server MUST verify this.  Small values can make it impossible
> 	for the server to send any protected message to the client,
> 	due to the overhead added by GSS_Wrap, and the server MAY
> 	reject the authentication if it detects this situation.</t>

s/, the server MUST verify this//

I see no value in the server verifying that client_maxbuf == 0 when the
client doesn't ask for any security layers.

Also, even with no security layers the application may benefit from the
SASL mechanism maxbuf negotiation (again, think of small devices).

So I think the entire second sentence should be removed.

>       <t>The "server_maxbuf" field indicate the maximum protected data
> 	buffer size the server can receive.  It MUST be 0 if the
> 	server doesn't advertise support for any security layer, the
> 	client MUST verify this.  Small values can make it impossible
> 	for the client to send any protected message to the server,
> 	due to the overhead added by GSS_Wrap, and the client MAY
> 	reject the authentication if it detects this situation.</t>

Same here.

Otherwise I'm happy.

Nico
--