Re: gs2 and qop

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

On Thu, Sep 07, 2006 at 12:07:01PM -0400, Sam Hartman wrote:
> 
> >>>>> "Simon" == Simon Josefsson <jas@xxxxxxxxxxx> writes:
> 
>     Simon> Is the consensus that GS2 should support GSS-API mechanisms
>     Simon> that doesn't offer integrity protection?
> 
> My opinion is yes, but that's an individual, not as an AD.

Jeff Hutzelman and I worked out the implications of this off-line just
now.

If we allow use of GSS-API mechanisms that don't offer integrity
protection then:

a) GS2 has to be modified so the client sends the authzid without
   wrapping;

b) SASL applications must be able to inquire which GS2 mechanisms offer
   integrity protection so they can avoid negotiating a mechanism that
   cannot provide what they want;

c) GSS mechs that can provide integ prot but fail to provide it for a
   given security context are a problem -- GS2 should fail
   authentication for such mechanisms when the security context fails to
   provide integrity protection and either the application wanted a
   security layer or wanted channel binding.

I take no position on whether GS2 should support GSS-API mechanisms that
cannot provide integrity protection.  Though I can probably be convinced
that it should.

Nico
--