Subject: Re: Holding gs2

From: Sam Hartman <[email-masked]>
Date: Tue, 11 Mar 2008 12:24:43 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Tue, Jan 29, 2008 at 12:16:36PM -0700, Chris Newman
    Nicolas> wrote:
    >> Speaking as a technical participant only...
    >> 
    >> As a SASL implementer, it is my current intention to not
    >> implement the "security layer" feature of SASL.  If I implement
    >> GS2, my implementation will always negotiate the GS2 security
    >> layer off and will use SSL/TLS channel bindings if there's any
    >> reasonable way I can get that working with the Mozilla/NSS
    >> library.

    Nicolas> Most SASL apps have StartTLS or TLS port options.  I'm
    Nicolas> inclined to believe that most SASL implementors would
    Nicolas> prefer to just do channel binding to TLS when you want
    Nicolas> security layers.

    Nicolas> So I'm now inclined to believe that Sam is right: we may
    Nicolas> have gone overboard with GS2.

Sam is horribly confused here.  In particular Nico seems to believe
I'm worried that you have to implement MIC tokens in pure SASL
mechanisms.  I don't think I've expressed that worry.

I think Nico is reading objections I've never made into my statements.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 11 Mar 2008 11:48:46 -0500

On Tue, Mar 11, 2008 at 12:24:43PM -0400, Sam Hartman wrote:
> Sam is horribly confused here.  [...]

Well, so am I.  Can we discuss this sometime this week?

Nico
--