Subject: Re: gs2 hashed oids

From: Arnt Gulbrandsen <[email-masked]>
Date: Thu, 8 Jan 2009 16:01:21 +0100

Jeffrey Hutzelman writes:
> Yes, but the SASL and GS2 implementation need not worry about this; 
> all they should need to do is call GSS_Indicate_mechs(), whose result 
> will include any composite mechanisms which are part of the default 
> set.  Or, it may use GSS_Indicate_mechs_by_mech_attrs() to list 
> mechanisms (including composite mechanisms) which have the attributes 
> GS2 requires.

I see. But then a different problem appears. It sounds as if the list 
may be long.

IMAP servers are required to return a list of available SASL mechanism 
on a single line, and that line shouldn't be too long. The relevant RFC 
cautions against lines longer than 8k, which gives space for about 350 
GS2 names after subtracting syntax and some other stuff, so I assume 
that problems will appear somewhere between 100 and 1000 GS2 mechanism 
stacks.

Other protocols (or common deployed implementations) may have limits, 
but I don't care to research that now, so I'll just take 100-1000.

How likely are 100-1000 OIDs? Unthinktable, possible, unusual or common?

Arnt