Subject: Re: GSS-API extensions for AEAD

From: Luke Howard <[email-masked]>
Date: Wed, 15 Sep 2004 09:36:42 +1000

Hi Martin,

>From what I remeber one needs additional API calls to even get
>throught security context establishment with secure DCE RPC
>before being able to call things like gss_wrap_ex()/gss_unwrap_ex().
>
>Microsoft has added the calls "CompleteAuthToken()" to their SSPI
>for that purpose, but there is no such call for GSS-API.

Interesting, I hadn't seen this -- according to the Remarks in MSDN
it is only called by the initiator. Perhaps this is because the RPC
authentication trailer contains the number of padding bytes, and
checksum is over the complete header including the authentication
trailer (excepting the mechanism token).

-- Luke

--

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Luke Howard <[email-masked]>
Date: Wed, 15 Sep 2004 10:10:57 +1000

>trailer (excepting the mechanism token).

Forget the above. It appears that CompleteSecurityContext() is called
after both AcceptSecurityContext() and InitializeSecurityContext().
(Which is probably what Martin said in the first place.)

Need to look into this more -- I've not found a need for this in our
implementation which is interoperable with SSPI under DCE.

-- Luke

--