Subject: RE: [I-D ACTION:draft-ietf-nfsv4-channel-bindings-00.txt]

From: "Linn, John" <[email-masked]>
Date: Thu, 30 Oct 2003 14:43:08 -0500

I've now read channel-bindings-00, and believe that it offers a valuable
result in two ways: by clarifying concepts of channel bindings (which have
long been one of the less well-understood aspects of GSS-API) and by
defining useful concrete facilities layered on the construct.  I'd encourage
others to review and comment as well; in particular, the details of linkages
to particular protocols should be evaluated by the experts and WGs involved
with those protocols.

One question: can the pseudo-mechanisms as discussed in Sec. 3.1 be used in
conjunction with SPNEGO-style negotiation, or are these types of
pseudo-mechanisms mutually exclusive?

--jl
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Nicolas Williams <[email-masked]>
Date: Thu, 30 Oct 2003 12:01:02 -0800

> to particular protocols should be evaluated by the experts and WGs involved

Great.

> pseudo-mechanisms mutually exclusive?

I was hoping to cross this bridge when I came to it.

If no SPNEGO apps have ever used channel bindings (and I'm quite sure
that that is indeed the case), then we could update the SPNEGO spec to
say that SPNEGO only passes channel bindings to mechanisms like CCM-* or
which otherwise explicitly require the use of channel bindings and that
applications that use SPNEGO MUST check the actual mech output parameter
of GSS_Init/Accept_sec_context() to determine whether channel bindings
were used.

Cheers,

Nico
--