Re: gs2 and qop

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Thu, Sep 07, 2006 at 04:33:21PM +0200, Simon Josefsson wrote:
> Sam Hartman <hartmans-ietf@xxxxxxx> writes:
> > Why do you negotiate qop?
> 
> All SASL mechanisms that support security layers negotiate qop,
> including GSSAPI and DIGEST-MD5.  Further, GS2 can use channel
> bindings to avoid another security layer, so it actually negotiates
> two qop's; one qop if the channel binding succeeds and another qop if
> the channel binding does not succeed.

"QoP" may mean different things here in the contexts of SASL and the
GSS-API.  In the SASL context it seems to be synonymous with "security
layer."  Whereas in the GSS-API context it means something much more
akin to SASL's "SSF" (but not quite).

GS2 does NOT negotiate GSS-API QoPs -- it should always use the default
GSS-API QoP (0).

Nico
--