Subject: Re: crypto performance and RPCSEC_GSS

From: Mike Eisler <[email-masked]>
Date: Fri, 20 Dec 2002 16:31:40 -0800

There several (non-AUTH_SYS) alternatives to use for a lightweight
identification only mechanism. I didn't intend to specify one at this time
but promise to propose something even more elegant if there's
consensus that the basic approach is what should be pursued.

 > AUTH_SYS at
 > all for this purpose, no way, because the server is already
 > mapping the
 > GSS initiator principal names to its internal identifiers and we must
 > preserve the server's ability to do so, whereas AUTH_SYS would take it
 > away (and besides, the server would have to ensure that the AUTH_SYS
 > data is valid for some established GSS context every time or
 > use it as a
 > GSS context lookup key - messy, messy).

Forgive me for my moment of weakness. Since implementors are already
willing to add krb5 to their feature set, the lightweight scheme shouldn't
be a big deal, as long as it is simple to code.

    -mre

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 20 Dec 2002 16:35:45 -0800

Heh.  You're forgiven :)

But, you know, ideally we could specify a way to "upgrade" the security
of the stream underlying RPC, much as with HTTP and TLS, then downgrade
the RPCSEC_GSS security.  This would probably require some RPC
extension, perhaps it could be done as a new flavor, without having to
modify NFSv4 at all.

Cheers,

Nico