Re: gs2 and qop

[Simon Josefsson <jas@xxxxxxxxxxx>]

Jeffrey Hutzelman <jhutz@xxxxxxx> writes:

>>> My opinion is yes, but that's an individual, not as an AD.
>
>> I take no position on whether GS2 should support GSS-API mechanisms that
>> cannot provide integrity protection.  Though I can probably be convinced
>> that it should.
>
> I believe that it should.  We have a tradition in SASL of supporting
> "authentication-only" mechanisms, some of which are widely deployed in
> configurations where integrity protection and confidentiality are
> provided at another layer.

Remember that this tradition have stopped, and appear to be actively
discouraged.

CRAM-MD5 is an example of such a mechanism.  CRAM-MD5 is not permitted
to enter the standards track, because (according to Sam) it doesn't
support integrity layers or channel bindings.  Any authentication-only
GS2 mechanisms will have the same problem.

I don't understand why an authentication-only GS2 mechanism is any
better than a "pure" SASL authentication-only mechanism.

A simple question that may illustrate the situation: Will there ever
by any more authentication-only SASL mechanisms on the standards
track?

If the answer is no, I'd argue that they shouldn't be permitted to be
specified through GS2 either.

Sam said yes to authentication-only GS2 mechanisms as individual,
perhaps we should solicit his opinion as AD.  I wouldn't want an IESG
member to say no to GS2 because it enables authentication-only
mechanisms on the Internet.

One consequence of support for authentication-only GS2 mechanisms: by
defining a CRAM-MD5 GSS-API mechanism, that would allow CRAM-MD5 to
continue to be used as a Standards Track protocol.  That seems counter
to the goal of refusing CRAM-MD5 to enter the standards track.

/Simon