Subject: [kitten] Updated SAML-EC draft

From: "Cantor, Scott E." <[email-masked]>
Date: Wed, 2 Mar 2011 01:35:20 +0000

I've revised my SAML-EC mechanism proposal:

https://datatracker.ietf.org/doc/draft-cantor-ietf-kitten-saml-ec/

The -01 version updates the underlying ECP profile reference to a new
draft version of this profile that is progressing at OASIS. The new
version of the profile adds channel binding (at the SAML layer) and
"holder-of-key" support as optional add-ons.

(HoK, for the SAML-oblivious, is the term of art in SAML for binding
assertion flows to cryptographic proof keys instead of using bearer
tokens.)

I think that the channel binding material, which is based on a long thread
between myself and Nico Williams last year, is sound *at the SAML layer*.
However, I'm fairly certain it needs to be modified or possibly just
duplicated for proper integration at the GSS-API mechanism layer, but I
will need some help from domain experts to make that happen. I can outline
how the SAML-based CB support works in Prague, it's fairly simple to
explain.

-- Scott