Subject: RE: comments on 2478bis (SPNEGO) I-D

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Wed, 15 Dec 2004 12:33:53 -0800

Sam Hartman wrote:
> In application protocols yes.  In this instance, if the acceptor sends
anything it should send the final > 
> token from the mechanism though even if it is an error token.

The error token must be optional because SSPI can not support context
level tokens that are produced when GSS_Init_sec_context() or
GSS_Init_accept_context() fails.

-- larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Wednesday, December 15, 2004 11:23 AM
To: [email-masked]
Subject: Re: comments on 2478bis (SPNEGO) I-D

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    >>  >>>>> "Nicolas" == Nicolas Williams <[email-masked]>
    >> writes:
    >> 
    Nicolas> [My comments take into account the changes agreed to in
    Nicolas> Similarly, for section 3.2, (c), (II), there may or may
    Nicolas> not be a mechanism token in the negotiation token when
    Nicolas> the state is request_mic -- if the mechanism outputs a
    Nicolas> token then it should be included in the negotiation token
    Nicolas> (except in the error token case, in which it should be
    Nicolas> optional).
    >>  Why is an error token optional?

    Nicolas> IIRC you've wanted error tokens and/or useful information
    Nicolas> in them to be optional and, anyways, initiators already
    Nicolas> have to be prepared to never hear from acceptors again,
    Nicolas> even in the middle of a context token exchange.

In application protocols yes.  In this instance, if the acceptor sends
anything it should send the final token from the mechanism though even
if it is an error token.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Sam Hartman <[email-masked]>
Date: Wed, 15 Dec 2004 15:41:58 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    >> In application protocols yes.  In this instance, if the
    Liqiang(Larry)> anything it should send the final >
    >> token from the mechanism though even if it is an error token.

    Liqiang(Larry)> The error token must be optional because SSPI can
    Liqiang(Larry)> not support context level tokens that are produced
    Liqiang(Larry)> when GSS_Init_sec_context() or
    Liqiang(Larry)> GSS_Init_accept_context() fails.

Don't let this discussion interrupt work on -04.

So, there are a lot of levels of optional here.  If the mechanism
returns gss_something_bad and generates an output token (something
that cannot happen on SSPI), I contend that SPNEGO must also output
this token.

I agree mechanisms may not have error tokens.  But if they do, SPNEGO
must not be the reason they are not delivered.  The application can of
course choose not to deliver the resulting SPNEGO token.