Subject: [Nea] Comment on PT-TLS I-D and SASL Negotiation

From: Susan Thomson <[email-masked]>
Date: Mon, 14 Nov 2011 19:27:31 -0500

I have another comment on the PT-TLS I-D re SASL negotiation.

Re Sections 3.4.2.2 and 3.8.3:

The text leaves it open as to whether the PTC or the PTS initiates the SASL
negotiation, leaving the possibility (if not the probability) that in
certain implementations neither side will start the exchange.

A common use case would be for the server to have the policy that requires
client authentication, in which case the server must send a SASL mechanisms
message (unless it can rely on the client kickstarting the negotiation,
which is not what is specified).

Of course, the other possibility (as the draft points out) is that both
sides start the negotiation at the same time and there is the potential for
a race condition.

It might be good to first go through common scenarios and the desired
behavior, and then make sure that the text in the spec reflects that desired
behavior. Right now, it seems that the spec allows for all possible options
of client trigger and server trigger, but in any particular scenario it is
not clear from the text what is expected to happen. It might also be the
case that the cost of supporting all these options may outweigh the benefit
--- the more cases we have, the more testing needs to be done and the
potential for interoperability issues rises. But before drawing this
conclusion, lets first be clear what use cases we think we need to support.

Thanks
Susan