Subject: RE: IDUP-GSS-API...

From: "Linn, John" <[email-masked]>
Date: Tue, 2 Dec 1997 15:57:56 -0500

Carlisle wrote, excerpting: 

> There is perhaps one final issue that should be debated (over the list
> or at the meeting or both).  Someone sent mail to me privately saying
> that tokens without the GSS-style "framing" were a bad idea because
> this
> breaks the interoperability of independent IDUP implementations [note
> that IDUP currently says that the framing is optional (decided by the
> mechanism spec.)].  This was discussed at a CAT meeting some time ago.
> The problem is that if someone decides to do an {S/MIME / OpenPGP /
> whatever} mechanism under IDUP, they probably don't want the framing
> because then they lose interoperability with all the non-IDUP
> implementations of that mechanism in the world.  On the other hand,
> without the framing, an IDUP_Get_token_details call cannot expect to
> return anything useful.
> 
The tradeoff in the GSS case favored tags in order to demultiplexing
among multiple mechanisms; interoperability between GSS-based and
non-GSS peers implementing a common mechanism hadn't been anticipated.
If, in the IDUP environment, unframed tokens are sufficient to enable
interoperability with existing non-IDUP protocol implementations, this
might motivate a different conclusion.  If unframed tokens are admitted,
would it be feasible and useful for a caller to be able to pass an
optional input OID to IDUP_Get_token_details, to designate the mechanism
against which an unframed token would be interpreted?  

--jl