Re: Holding gs2

[Sam Hartman <hartmans-ietf@xxxxxxx>]

>>>>> "Nicolas" == Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:

    Nicolas> On Tue, Jan 29, 2008 at 12:16:36PM -0700, Chris Newman
    Nicolas> wrote:
    >> Speaking as a technical participant only...
    >> 
    >> As a SASL implementer, it is my current intention to not
    >> implement the "security layer" feature of SASL.  If I implement
    >> GS2, my implementation will always negotiate the GS2 security
    >> layer off and will use SSL/TLS channel bindings if there's any
    >> reasonable way I can get that working with the Mozilla/NSS
    >> library.

    Nicolas> Most SASL apps have StartTLS or TLS port options.  I'm
    Nicolas> inclined to believe that most SASL implementors would
    Nicolas> prefer to just do channel binding to TLS when you want
    Nicolas> security layers.

    Nicolas> So I'm now inclined to believe that Sam is right: we may
    Nicolas> have gone overboard with GS2.

Sam is horribly confused here.  In particular Nico seems to believe
I'm worried that you have to implement MIC tokens in pure SASL
mechanisms.  I don't think I've expressed that worry.

I think Nico is reading objections I've never made into my statements.