Subject: [Nea] Comment re PT-TLS and SASL mechanism negotiation

From: Susan Thomson <[email-masked]>
Date: Mon, 14 Nov 2011 19:50:38 -0500

I have a comment on PT-TLS I-D and SASL mechanism negotiation.

Re Sections 3.4.2.2. and 3.8.3:

The text is unclear as to whether the PTC or the PTS starts the negotiation,
leaving the possibility (if not the probability) that in a particular
implementation neither side initiates the exchange (or both).

In the common use case where the server has the policy requiring a client to
authenticate, it must send a SASL mechanism message (unless the client is
required to initiate the exchange, which is not what the spec currently
says).

It might be good to first list out the common use cases we need to support
and the desired behavior, and then make sure that the draft reflects that.
Right now, the draft supports all possible options, and it is not always
clear what is expected to happen in any particular scenario. It also may be
the case that the cost of supporting all these use cases outweighs the
benefit - the more use cases we have, the more testing needs to be done, and
the potential for interoperability issues rises. But before we reach this
conclusion, it would be good to first clarify what use cases we think we
need to support.

Thanks
Susan