Subject: Telnet authenticaiton, GSSAPI and SASL

From: Chris Newman <[email-masked]>
Date: Thu, 05 Feb 1998 13:07:42 -0800 (PST)

At the last TN3270e meeting, I was tasked with writing a spec for use of
SASL and GSSAPI in telnet, which I did:

 <ftp://ds.internic.net/internet-drafts/draft-newman-telnet-sasl-00.txt>

However, Ted Ts'o has just issued revisions of the old telnet
authentication/encryption options and previously undocumented Kerberos 5
mechanism.

I had a long talk with Ted and he convinced me that SASL and GSSAPI just
don't fit well into the telnet protocol because their security layers add
too much overhead to user keystrokes over slow links.  So it is probably
better if we stick with the old authentication/encryption options for
telnet and TN3270.  If there is any SASL mechanism which people would like
to use with telnet, I'll offer to write a telnet authentication option
profile of that mechanism.

                - Chris

---

From: Michael Boe <[email-masked]>
Date: Thu, 5 Feb 1998 14:34:00 -0800 (PST)

> profile of that mechanism.

Thanks for that, Chris.  I too talked to Ted recently....looks like we're at
least on the same page. Which is almost surreal, given the myriad of security
options nowadays. Unless, of course, things have changed since yesterday :-).

/msb