Subject: sasl-gssapi questions: base32 and context flags

From: "John Brezak" <[email-masked]>
Date: Mon, 4 Jun 2001 18:21:07 -0700

Is the base32 encoding method used for anything other than the 10 bytes
used in the suffix for the gssapi mechanism encoding? If so why go
through all of this complexity - why not just use the text version of
the OID for the mechtype?

There should also be some details about the mapping of the SASL
protection profile mapping to the GSSAPI context establishment flags
(GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG). This should also be extended to
cover the use of the context flags in NegTokenInit of SPNEGO and the
GSSAPI Context flags specified in the optimistic protocol.

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
John Brezak                       * mailto:[email-masked]
Microsoft Corporation        * 425-936-2602
One Microsoft Way
Redmond, WA 98052

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 04 Jun 2001 20:33:46 -0600

> the OID for the mechtype?

IMHO, there are two reasons:

1). Allowed characters for mechanism name are uppercase letters, digits,
"-" and "_" (thus "." is not allowed)
2). There is a limit of 20 characters for mechanism name. Having prefix
"GSS-" this leaves 16 characters.

__________________________________________
Alexey Melnikov
R & D, ACI Worldwide (formerly MessagingDirect Ltd.)
phone 780.424.4922 x357

I speak for myself only, not for my employer.
__________________________________________

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 05 Jun 2001 11:33:37 -0700

John Brezak wrote:
> (GSS_C_CONF_FLAG and GSS_C_INTEG_FLAG).

I see no mention of either "GSS_C_CONF_FLAG" or "GSS_C_INTEG_FLAG" in
RFC 2743.  The appropriate use of conf_req_flag, integ_req_flag,
sequence_req_flag, and mutual_req_flag is specified in
draft-ietf-cat-sasl-gssapi-05?

> This should also be extended to

Why is such extension necessary?  Does not the SPNEGO draft already
specify this?

Please be more specific as to what is underspecified.  Proposed wording
would be particularly helpful.

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 05 Jun 2001 11:35:47 -0700

John Brezak wrote:
> used in the suffix for the gssapi mechanism encoding?

No.

---

From: Alexey Melnikov <[email-masked]>
Date: Mon, 04 Jun 2001 20:33:46 -0600

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 05 Jun 2001 11:33:37 -0700

---

From: John Gardiner Myers <[email-masked]>
Date: Tue, 05 Jun 2001 11:35:47 -0700

No.