Re: gs2 and qop

[Sam Hartman <hartmans-ietf@xxxxxxx>]

>>>>> "Simon" == Simon Josefsson <jas@xxxxxxxxxxx> writes:

    >> Are you talking about gss-api level qop or sasl security
    >> layers?

    Simon> SASL security layers.

I skip your answers to the rest of my questions because they assumed
you meant GSS QOP.

I'm failing to see the downgrade attack here though: if integ_avail is
false, you don't negotiate security layers.
Provided you enforce that what is the downgrade issue.

Some editorial comments on the draft:

In your examples you do separate parts of packets input to gss_wrap
with ,.  I'd suggest |.

You never clearly define that the qop values you talk about correspond
to the security layer stuff in section 9.