Subject: Re: I-D Action:draft-ietf-sasl-gs2-14.txt

From: Alexey Melnikov <[email-masked]>
Date: Wed, 08 Jul 2009 13:11:57 +0100

[email-masked] wrote:

>A New Internet-Draft is available from the on-line Internet-Drafts directories.
>This draft is a work item of the Simple Authentication and Security Layer Working Group of the IETF.
>
>
>	Title           : Using GSS-API Mechanisms in SASL: The GS2 Mechanism Family
>	Author(s)       : S. Josefsson, N. Williams
>	Filename        : draft-ietf-sasl-gs2-14.txt
>	Pages           : 23
>	Date            : 2009-06-27
>  
>
Some quick comments.

In Section 3.5:

>    If the client negotiates mechanisms then clients MUST select the
>    PLUS-variant if offered by the server.

This make sense.

> Otherwise, if the client does
>    not negotiate mechanisms then it MUST use the non-PLUS variant.

This doesn't make much sense. If the client remembers what the server 
advertised previously, then it can just use the same mechanism.
But even if the client never negotiate mechanisms (e.g. if the user 
selected the mechanism in UI), then why should it be restricted to 
non-PLUS variant?

In Section 5.1:

>    The application-data field MUST be set to the gs2-header concatenated
>    with, when a gs2-cb-flag of "p" is used, the application's channel
>    binding data (if any).

I think "(if any)" should be removed, because for "p" the channel 
binding data is always present. I assume that a channel binding data 
can't be the empty string.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 8 Jul 2009 10:46:13 -0500

> selected the mechanism in UI), then why should it be restricted to 

I think that text had been intended to say that the non-PLUS variant
must be selected when the client has no idea what the server supports
and the client isn't using CB.  But it doesn't really matter.  I'd be
happy with removing this text.

> can't be the empty string.

Sure.

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 08 Jul 2009 17:31:53 +0100

>happy with removing this text.
Alternatively I suggest correcting the text to read something like this:

    Otherwise (the client does not negotiate mechanisms),
    if the client has no prior knowledge about mechanisms supported
    by the server and wasn't explicitly configured to use a particular
    variant of the GS2 mechanism, then it MUST select
    only non-PLUS version of the GS2 mechanism.

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 29 Jul 2009 13:48:12 +0200

Alexey Melnikov <[email-masked]> writes:

>>> This doesn't make much sense. If the client remembers what the
>>> server advertised previously, then it can just use the same
>>> mechanism.

Works fine with me.  I have made this change in my local copy.

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 29 Jul 2009 14:13:23 +0200

>> can't be the empty string.

I have removed this in my local copy.

/Simon