Subject: [abfab] Channel bindings

From: Sam Hartman <[email-masked]>
Date: Fri, 10 Sep 2010 14:21:13 -0400

Does the EAP GSS mechanism need to support address based channel binding
or just application data?

--Sam

---

From: Simon Wilkinson <[email-masked]>
Date: Fri, 10 Sep 2010 19:26:39 +0100

> or just application data?

Do address based channel bindings actually have any value in this day and age?

Simon.

---

From: Sam Hartman <[email-masked]>
Date: Fri, 10 Sep 2010 14:28:52 -0400

>>>>> "Simon" == Simon Wilkinson <[email-masked]> writes:

    >> or just application data?

    Simon> Do address based channel bindings actually have any value in
    Simon> this day and age?

If you're binding to an IPv6 CGA and using something like
draft-dong-savi-cga, yes.  However it would be easy to register an RFc
5056 channel type for that.  I'd probably choose not to support
addresses if it were up to me.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 10 Sep 2010 13:43:48 -0500

> or just application data?

If you can do channel bindings at all, then supporting the crappy
network address fields of the old RFC2744 (or new RFC5554) cb struct is
also doable.

Of course, I'd happily deprecate network address CB.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 10 Sep 2010 13:44:51 -0500

> addresses if it were up to me.

+1.  End-point CB types should be used as "application-data" CB.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 10 Sep 2010 13:45:57 -0500

Ah, and RFC5554 says:

   Where a language binding of the GSS-API models channel bindings as
   OCTET STRINGs (or the language's equivalent), then the implementation
   MUST assume that the given bindings correspond only to the
   application-data field of GSS-CHANNEL-BINDINGS as shown above, rather
   than some encoding of GSS-CHANNEL-BINDINGS.

   ...

   However, it is important that "end-point channel bindings" not be
   modeled as network addresses; otherwise, such channel bindings may
   not be useable with all language bindings of the GSS-API.

Nico
--

---

From: Luke Howard <[email-masked]>
Date: Fri, 10 Sep 2010 22:23:21 +0200

> Of course, I'd happily deprecate network address CB.

+1

---

From: Sam Hartman <[email-masked]>
Date: Fri, 10 Sep 2010 17:01:14 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Fri, Sep 10, 2010 at 02:21:13PM -0400, Sam Hartman wrote:
    >> Does the EAP GSS mechanism need to support address based channel
    >> binding or just application data?

    Nicolas> If you can do channel bindings at all, then supporting the
    Nicolas> crappy network address fields of the old RFC2744 (or new
    Nicolas> RFC5554) cb struct is also doable.

Right.
I agree we should support the struct.
My question is whether we should actually do anything with the network
address fields.

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 10 Sep 2010 16:31:47 -0500

> My question is whether we should actually do anything with the network

As RFC5554 says, end-point CB, even if the end-point CB happen to be
CGA-like network addresses.

Nico
--