Subject: Re: [kitten] publication request for draft-josefsson-gss-capsulate-03.txt

From: Simon Josefsson <[email-masked]>
Date: Tue, 05 Apr 2011 23:50:46 +0200

All,

There is a quick -04 with some minor fixes:

http://tools.ietf.org/html/draft-josefsson-gss-capsulate-04
http://tools.ietf.org/rfcdiff?url2=draft-josefsson-gss-capsulate-04.txt

The document now contains a test vector.  I have interop tested the
encapsulation and decapsulation function from Heimdal and GNU GSS as
shipped with stable Debian Squeeze using the code below.

/Simon

/*

Install required packages:
# apt-get install libgss-dev heimdal-multidev

Compile and run like this for GNU GSS:

$ gcc -DGNU_GSS -o capsulate capsulate.c -lgss && ./capsulate 
OID (9 bytes): \x2a\x86\x48\x86\xf7\x12\x01\x02\x02
OUT (16 bytes): \x60\x0e\x06\x09\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x66\x6f\x6f
$ 

Compile and run like this for Heimdal (heimdal-multidev):

$ gcc -L/usr/lib/heimdal -I/usr/include/heimdal -o capsulate capsulate.c -lgssapi && ./capsulate 
OID (9 bytes): \x2a\x86\x48\x86\xf7\x12\x01\x02\x02
OUT (16 bytes): \x60\x0e\x06\x09\x2a\x86\x48\x86\xf7\x12\x01\x02\x02\x66\x6f\x6f
$ 

*/

#include <stdio.h>
#ifdef GNU_GSS
# include <gss.h>
#else
# include <gssapi.h>
#endif

int
main (void)
{
  OM_uint32 maj_stat, min_stat;
  gss_buffer_desc tok1 = { 3, "foo" };
  gss_buffer_desc tok2;
  gss_OID_desc oid = { 9, "\x2a\x86\x48\x86\xf7\x12\x01\x02\x02" };
  size_t i;

  printf ("OID (%d bytes): ", oid.length);
  for (i = 0; i < oid.length; i++)
    printf ("\\x%02x", ((char*) oid.elements)[i] & 0xFF);
  printf ("\n");

  maj_stat = gss_encapsulate_token (&tok1,
				    &oid,
				    &tok2);
  if (GSS_ERROR(maj_stat))
    {
      printf ("ERROR\n");
      return 1;
    }

  printf ("ENC (%d bytes): ", tok2.length);
  for (i = 0; i < tok2.length; i++)
    printf ("\\x%02x", ((char*) tok2.value)[i] & 0xFF);
  printf ("\n");

  if (tok2.length != 16
      || memcmp (tok2.value,
		 "\x60\x0e\x06\x09\x2a\x86\x48\x86"
		 "\xf7\x12\x01\x02\x02\x66\x6f\x6f",
		 16) != 0)
    {
      printf ("FAIL\n");
      return 1;
    }

  maj_stat = gss_decapsulate_token (&tok2,
				    &oid,
				    &tok1);
  if (GSS_ERROR(maj_stat))
    {
      printf ("ERROR\n");
      return 1;
    }

  printf ("DEC (%d bytes): ", tok1.length);
  for (i = 0; i < tok1.length; i++)
    printf ("\\x%02x", ((char*) tok1.value)[i] & 0xFF);
  printf ("\n");

  if (tok1.length != 3 || memcmp (tok1.value, "foo", 3) != 0)
    {
      printf ("FAIL\n");
      return 1;
    }

  gss_release_buffer (&min_stat, &tok1);
  gss_release_buffer (&min_stat, &tok2);

  return 0;  
}

---

From: Greg Hudson <[email-masked]>
Date: Tue, 05 Apr 2011 18:25:58 -0400

> shipped with stable Debian Squeeze using the code below.

Also confirmed for Luke's implementation in MIT krb5 (now on the trunk).

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 06 Apr 2011 11:58:15 +0200

> Also confirmed for Luke's implementation in MIT krb5 (now on the trunk).

Thanks!

/Simon