Subject: Re: GSS-API extensions for AEAD

From: Luke Howard <[email-masked]>
Date: Tue, 14 Sep 2004 13:33:18 +1000

>Where exactly is the difference between your gss_wrap_ex(), gss_unwrap_ex()
>and the EXISTING gss_getmic() gss_verifymic()?

gss_wrap_ex() can also encrypt some of the provided data while
checksumming over the lot.

>As far as I remember, the GSS-API was originally designed
>by Engineers at Digital Equipment Coorporation (DEC) for use
>with DCE.

DCE provided GSS-API so that developers could add DCE security
to non-DCE applications with a minimum of effort. However, RPC
continued to use Kerberos natively for authentication.

Some vendor implementations of DCE use GSS for RPC authentication
in order to support multiple mechanisms and cryptosystems. Using
GSS-API with Kerberos in this manner is not interoperable with
Kerberos authentication in OSF DCE.

-- Luke

--

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Martin Rex <[email-masked]>
Date: Tue, 14 Sep 2004 18:30:04 +0200 (MET DST)

> checksumming over the lot.

OK, I see.  That is not possible with gss_getmic/gss_verifymic.

>From what I remeber one needs additional API calls to even get
throught security context establishment with secure DCE RPC
before being able to call things like gss_wrap_ex()/gss_unwrap_ex().

Microsoft has added the calls "CompleteAuthToken()" to their SSPI
for that purpose, but there is no such call for GSS-API.

Is that what Microsoft does via CompleteAuthToken() not necessary,
or is/can the necessary information be supplied via ChannelBindings
(Microsoft's SSPI doesn't have channel bindings)?

-Martin