Subject: Does rfc2222bis need text on channel bindings?

From: Nicolas Williams <[email-masked]>
Date: Thu, 12 Aug 2004 19:47:13 -0500

I figure the new SASL GSS mech document will say something about channel
bindings, but perhaps rfc2222bis should also.

Specifically I think that rfc2222bis could use:

a) Security Considerations text about use of mechanisms that don't
   support channel bindings in conjunction with TLS.

   Clients should be admonished to validate TLS server IDs to prevent
   MITM attacks when using SASL-over-TLS.  Similarly with other variants
   of SASL-over-TLS.

   SACRED is an example of an application where such text could be
   useful.

b) Text recommending support for channel bindings in future mechanisms,
   where possible.  Digest-MD5, for example, could easily support
   channel bindings.

Comments?  Shall I just send proposed text to the list?

Nico
--