[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Where do we stand? (Re: Poll: use of TLS channel bindings in SCRAM)





On May 29, 2009, at 10:29 PM, Nicolas Williams wrote:
Kurt has not told us where he stands on our proposal.

While I have stated a number of concerns, but in general and specifically in response to your proposal, I have yet decided whether I support your proposal. As I noted in Jeffrey's message, I am currently considering the impacts of your proposal on possible negotiation solutions. I do plan on making a stand before the poll expires.

Kurt has told us where he stands on the poll: a variant of option 3 is
his preferred approach.  Specifically Kurt prefers (preferred?) a
solution where we do channel binding type negotiation now, and we do it
via SASL mechanism names that incorporate both, an actual mechanism
name, and the name of a single channel binding type.  That was before
Jeff and I made our proposal.

I also plan on revising my poll response, primarily in response to various proposals (including but not limited to yours).

Our proposal does not, in fact, preclude Kurt's preferred approach -- it
only defers the addition of channel binding type negotiation to some
future time.  Kurt has aknowledged this.

Well, while I would agree that your proposal doesn't preclude my approach, I wouldn't say it "only defers the addition ...". I do think your proposal does place my approach at a slight disadvantage in subsequent engineering discussions. To illustrate this point, consider whether you would agree to changing SCRAM-*-PLUS to SCRAM-*- TLS-END-POINT now. I suspect you would object to this, because the negotiation solutions you favor would no need for this. But likewise, my negotiation approach has no need for SCRAM-*-PLUS.

But as I noted in my comments, I consider this to be quite a minor disadvantage. While I certainly will consider this impact, I don't think it will be a major deciding factor on what stand I take in the end.

-- Kurt