Subject: GSS-SPNEGO and relative mechanism strengths

From: Nicolas Williams <[email-masked]>
Date: Wed, 27 Aug 2003 17:37:02 -0500

The SASL GSS-SPNEGO mechanism, on the client side, needs to know the
mechlist that the client got from the server and the SSF values
associated with each GSS-API mechanism available to decide which
mechanisms to negotiate.

(See section 4 of draft-ietf-cat-sasl-gssapi-05.txt.)

How can a SASL GSS-SPNEGO mechanism client-side implementation determine
the SSF values that would be associated with each GSS-API mechanism
without hardcoding mechanism OIDs and SSF values?

A GSS-API extension, GSS_Inquire_mech(), say, that allows applications
to determine the set of features supported by a given mechanism would
help.

The relative strengths of GSS-API mechanisms that support
confidentiality (SSF values > 1) can't really be determined statically,
or even dynamically (it is not even possible to determine what QoPs will
be available with what mech until a context is established), so ideally,
if GSS_Inquire_mech() says anything about mechanism strength at all then
that should be configurable.

(And if GSS_Inquire_mech() has nothing at all to say about mech
 strength, then truly generic SASL GSS-SPNEGO mechanism client-side
 implementation might have to assume SSF values for mechs that provide
 confidentiality, perhaps a single value for all such GSS-API mechs.)

Cheers,

Nico
--