Re: Holding gs2

[Simon Josefsson <simon@xxxxxxxxxxxxx>]

Sam Hartman <hartmans-ietf@xxxxxxx> writes:

>>>>>> "Simon" == Simon Josefsson <simon@xxxxxxxxxxxxx> writes:
>
>     Simon> Sam Hartman <hartmans-ietf@xxxxxxx> writes:
>     >> I have a question for the SASL working group.  With the
>     >> exception of the question I brought up about optimal round
>     Simon> I fear this would delay GS2 implementations for Kerberos
>     Simon> V5, which would give us useful feedback on other aspects of
>     Simon> the document.
>
> Are there any implementers of SASL or Kerberos stacks who plan to delay?

I have started to implement GS2 twice to test the Kerberos V5 reduced
round-trip mode.  The protocol kept changing, even after passing WGLC,
so I postponed those efforts pending a stable draft.  I recently planned
to resume work on GS2 during February, but this discussion suggests to
me that I need to wait longer.  Publishing GS2, with the limited
applicability for Kerberos would move my effort forward.

I'd be interested in understanding how other implementers think about
this too.

I don't see why having three mechanisms to do the same is problematic.
Ok, it does lead to complexity, but supposedly the complexity is
_required_ in order to solve some identified problem.  GS2 solves the
identified problem of unnecessary many round-trips compared to Kerberos
V5 via GSS-API.  If we don't consider that a valid problem, we should
say that GS2 should not be used with Kerberos V5 at all, and instead say
that users should use GSS-API for this.  That approach would take away
all the complexity for Kerberos in GS2.  If we go this route, I would
support delaying publication of GS2 until we have specifications of the
GSS-API mechanisms that were designed with GS2 in mind.

If I recall correctly, the use-case of hybrid SASL and GSS-API
mechanisms was established after we decided to do GS2.

/Simon