Subject: SACRED Protocol

From: "Gareth Richards" <[email-masked]>
Date: Thu, 22 Nov 2001 08:17:32 -0000

I have been going through the SACRED mail archive to try and get an
understanding of how SACRED will handle authentication and transport and I
wanted to check that I understand the current situation.

The proposal appears to be that SACRED will rely on the built-in security
of the transport and so will be limited in the transport systems it can
use.  Since BEEP can use the SASL-SRP mechanism to provide both mutual
authentication and a session encryption key it can be used.  Isn't this
approach, rather than having a self-contained protocol specifying the use
of SASL, going to cause problems if other transport protocols such as
XML-Protocol are used?

For example, I've noticed that the draft charter for the W3C XKMS WG [1]
proposes "harmonizing the SACRED protocol layer with the X-KRSS roaming
operation".  It could be desirable for the same technology to be applied
for this purpose in both environments.  It seems, however, that XKMS is
likely to specify XML-Protocol as its initial binding and to follow an
approach where security sublayers (XMLDSig, XML Encryption) are directly
applied to the XKMS application protocol, rather than being consumed from
an underlying transport.

[1]
http://lists.w3.org/Archives/Public/www-xkms-ws/2001Oct/att-0011/01-xkms-ch
arter.html

Gareth Richards

RSA Security

---

From: "Eamon O'Tuathail" <[email-masked]>
Date: Thu, 22 Nov 2001 10:20:13 -0000

BEEP is designed so that it can run across multiple transports, based on
a transport mapping (section 2.5 of RFC 3080).  

RFC3081 defines one transport mapping to TCP, and similar mappings are
possible for other transports (e.g. SCTP).  

Hence, SACRED over BEEP is transport-independent. It can work with any
transport mapping defined under BEEP. 

Eamon O'Tuathail
http://www.clipcode.com

---

From: "Gareth Richards" <[email-masked]>
Date: Thu, 22 Nov 2001 15:15:45 -0000

When I referred to transport protocols, I meant the messaging frameworks
such as SOAP or BEEP.  It is true that BEEP can run on top of different
transport protocols but the issue I was raising was that the current SAML
draft seems to blur the distinction between these frameworks and the
authentication protocols such as SASL.

Sorry for the misunderstanding.

> -----Original Message-----
> From: [email-masked]
> [mailto:[email-masked]]On Behalf Of Eamon O'Tuathail
> Sent: 22 November 2001 10:20
> To: 'Gareth Richards'; [email-masked]
> Subject: RE: SACRED Protocol
>
>
>
>

---

From: "Gareth Richards" <[email-masked]>
Date: Thu, 22 Nov 2001 15:32:17 -0000

I of course meant SACRED not SAML!

Sorry for even more confusion.