On Thursday, September 07, 2006 12:12:55 PM -0500 Nicolas Williams <Nicolas.Williams@xxxxxxx> wrote:
On Thu, Sep 07, 2006 at 12:07:01PM -0400, Sam Hartman wrote:>>>>> "Simon" == Simon Josefsson <jas@xxxxxxxxxxx> writes: Simon> Is the consensus that GS2 should support GSS-API mechanisms Simon> that doesn't offer integrity protection? My opinion is yes, but that's an individual, not as an AD.
I take no position on whether GS2 should support GSS-API mechanisms that cannot provide integrity protection. Though I can probably be convinced that it should.
I believe that it should. We have a tradition in SASL of supporting "authentication-only" mechanisms, some of which are widely deployed in configurations where integrity protection and confidentiality are provided at another layer. To the extent that GSS mechanisms with those properties exist, IMHO it would be a mistake not to allow their use in SASL.
-- Jeff