Re: [TLS] SPNEGO over TLS - proposed new work item

[Martin Rex <martin.rex@xxxxxxx>]

Stefan Santesson wrote:
> 
> We had a design meeting today to conclude discussions about this proposal
> that has surfaced during the IETF week.
> 
> As such the proposal has changed in the way that SPNEGO has been removed
> from the proposal and replaced with  direct exchange of GSS-API tokens.
> The slides for the presentation tomorrow has been sent to Eric and should
> be up on the meeting materials page before the TLS meeting.
> 
> A first draft will be available for consideration short after this IETF
> and Jeff Altman has agreed to help as co-editor.

A thought that came to me during todays tls meeting was the following:

With exiting SSL/TLS (and -implementations), the authenticated peer
becomes part of the SSL session state in the SSL session cache.

When including an "external" authentication in the TLS handshake,
what happens with the information about the authenicated peer,
how is it "persistet", so that it will be transparently available
when that SSL session is later resumed?

Some features of existing GSS-API mechanisms (and future features,
in particular about authorization attributes and subject alt name
retrieval) might be extremely non-trivial to persist in the
SSL session cache.

-Martin

_______________________________________________
TLS mailing list
TLS@xxxxxxxxxxxxxx
https://www1.ietf.org/mailman/listinfo/tls