Re: gs2 and qop

[Simon Josefsson <jas@xxxxxxxxxxx>]

Alexey Melnikov <alexey.melnikov@xxxxxxxxx> writes:

> Nicolas Williams wrote:
>
>>If we allow use of GSS-API mechanisms that don't offer integrity
>>protection then:
>>
>>a) GS2 has to be modified so the client sends the authzid without
>>   wrapping;
>>  
>>
> Why does this matter?

Mechanisms that doesn't provide integrity likely won't support the
GSS_Wrap function.

If integ_avail isn't set, GS2 would have to use another token to
transfer the authorization identity, it can't use GSS_Wrap.  The
maxbuf, channel binding and SASL qop fields are not relevant in this
case, leaving only the authorization identity.

/Simon