Subject: Re: GSS-API QoPs and SASL SSF (Re: SASL always returns ssf=56 for GSSAPI)

From: Sam Hartman <[email-masked]>
Date: Wed, 01 Nov 2006 19:43:29 -0500

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> Cc'ing KITTEN to record my thoughts on this topic, which
    Nicolas> started out as a question about the SASL SSF of the SASL
    Nicolas> "GSSAPI" mechanism (as in "why is it always 56?").

    Nicolas> IMO absolute SSF values are a broken concept, and
    Nicolas> dangerous too, because the relative strengths of
    Nicolas> individual cryptographic algorithms and constructions
    Nicolas> vary over time as cryptanalysis develops.

    Nicolas> Local SSF assignments based on local policy that does not
    Nicolas> rely on a notion of absolute strength would be better.

Keep in mind that ssf is a implementation detail of at least one
implementation and does not appear as part of SASL.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten