Subject: I-D ACTION:draft-ietf-cat-snego-07.txt

From: [email-masked]
Date: Wed, 19 Nov 1997 12:02:47 -0500

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Common Authentication Technology Working Group of the IETF.

	Title		: The Simple and Protected GSS-API Negotiation Mechanism
	Author(s)	: D. Pinkas, E. Baize
	Filename	: draft-ietf-cat-snego-07.txt
	Pages		: 13
	Date		: 18-Nov-97
	
This draft document specifies a Security Negotiation Mechanism for the
Generic Security Service Application Program Interface (GSS-API) which
is described in [1].
 
The GSS-API provides a generic interface which can be layered atop
different security mechanisms such that if communicating peers acquire
GSS-API credentials for the same security mechanism, then a security
7context may be established between them (subject to policy). However,
GSS-API doesn't prescribe the method by which GSS-API peers can
establish whether they have a common security mechanism.
 
The Simple and Protected GSS-API Negotiation Mechanism defined here
is a pseudo-security mechanism, represented by the object identifier
iso.org.dod.internet.security.mechanism.snego (1.3.6.1.5.5.2) which
enables GSS-API peers to determine in-band whether their credentials
share common GSS-API security mechanism(s), and if so, to invoke
normal security context establishment for a selected common security
mechanism. This is most useful for applications that are based on
GSS-API implementations which support multiple security mechanisms.

This allows to negotiate different security mechanisms, different
options within a given security mechanism (such as different
cryptographic algorithms due to policy or legislative constraints)
or different options from several security mechanisms.
 
Once the common security mechanism is identified, the mechanism may
then negotiate mechanism-specific options during its context
establishment. This will be inside the mechanism tokens, and
invisible to the SPNEGO protocol.
 
The simple and protected GSS-API mechanism negotiation is based on the
following negotiation model : the initiator proposes one security
mechanism or an ordered list of security mechanisms, the target either
accepts the proposed security mechanism, or chooses one from an
offered set, or rejects the proposed value(s). The target then informs
the initiator of its choice.
 
In its basic form this protocol requires an extra-round trip. Network
connection setup is a critical performance characteristic of any
network infrastructure and extra round trips over WAN links, packet
radio networks, etc. really make a difference. In order to avoid such
an extra round trip the initial security token of the preferred
mechanism for the initiator may be embedded in the initial token.
If the target preferred mechanism matches the initiator's preferred
mechanism, no additional round trips are incurred by using the
negotiation protocol.
 
The simple and protected GSS-API mechanism negotiation provides a
technique to protect the negotiation that must be used when the
underlying mechanism selected by the target is capable of integrity
protection.
 
When all the mechanisms proposed by the initiator support integrity
protection or when the selected mechanism supports integrity
protection, then the negotiation mechanism becomes protected since
this guarantees that the appropriate mechanism supported by both
peers has been selected.

The Simple and Protected GSS-API Negotiation Mechanism uses the
concepts developed in the GSS-API specification [1]. The negotiation
data is encapsulated in context-level tokens. Therefore, callers of
the GSS-API do not need to be aware of the existence of the
negotiation tokens but only of the new pseudo-security mechanism.
A failure in the negotiation phase causes a major status code to be
returned: GSS_S_BAD_MECH.

Internet-Drafts are available by anonymous FTP.  Login with the username
"anonymous" and a password of your e-mail address.  After logging in,
type "cd internet-drafts" and then
	"get draft-ietf-cat-snego-07.txt".
A URL for the Internet-Draft is:
ftp://ds.internic.net/internet-drafts/draft-ietf-cat-snego-07.txt

Internet-Drafts directories are located at:

	Africa:	ftp.is.co.za
	
	Europe: ftp.nordu.net
		ftp.nis.garr.it
			
	Pacific Rim: munnari.oz.au
	
	US East Coast: ds.internic.net
	
	US West Coast: ftp.isi.edu

Internet-Drafts are also available by mail.

Send a message to:	[email-masked].  In the body type:
	"FILE /internet-drafts/draft-ietf-cat-snego-07.txt".
	
NOTE:	The mail server at ds.internic.net can return the document in
	MIME-encoded form by using the "mpack" utility.  To use this
	feature, insert the command "ENCODING mime" before the "FILE"
	command.  To decode the response(s), you will need "munpack" or
	a MIME-compliant mail reader.  Different MIME-compliant mail readers
	exhibit different behavior, especially when dealing with
	"multipart" MIME messages (i.e. documents which have been split
	up into multiple messages), so check your local documentation on
	how to manipulate these messages.

Below is the data which will enable a MIME compliant mail reader
implementation to automatically retrieve the ASCII version of the
Internet-Draft.