Optimizing use of SASL/GS2 over TLS

[Nicolas Williams <Nicolas.Williams@xxxxxxx>]

[Note: SASL and KITTEN WGs are Bcc'ed.]

I've submitted an I-D describing how to reduce the number of round trips
needed for SASL/GS2 mechanism negotiation and authentication when
running over TLS:

    draft-williams-tls-app-sasl-opt-01.txt

This can be seen as a variant of the TLS/GSS proposal from a while back
as it achieves the same result: you can use the GSS-API for
authentication _and_ TLS for session protection without having to pay a
round trip penalty.  But it does it in a slightly different and simpler
way.

I'm hoping this proposal will be less controversial than the TLS/GSS
proposal.

Comments?

Nico
--