Subject: Re: Planning for DC IETF CAT session

From: Matt Hur <[email-masked]>
Date: Fri, 07 Nov 1997 14:53:43 -0800

At 11:35 AM 10/30/97 -0800, Mike Swift wrote:
 ... 
>There are far too many groups that are inventing their own
>authentication and security negotation mechanisms and I believe the CAT
>group should either do more evangelizing of its current technologies or
>really look at why what it has today doesn't work and come up with some
>plans to address their issues.
>
>- Mike

To which I responded:

> Take another example:
> LDAP specifies the use of SASL for authentication negotiation, and I
> believe that they intend to use SSL/TLS for encryption (i.e. run an LDAP
> session over SSL).  LDAP seems to be a likely candidate for the
> evangelizing of current technologies that Mike suggests.  They already, use
> ASN.1 encoding.  So, why is SASL seen as a better alternative to GSS-API?
> Is it because SASL is perceived to be easier and offer more flexibility?

And then, Martin replied:

At 10:35 PM 11/7/97 +0100, Martin Rex wrote:
>
>GSS-API is not a complete on-the-wire protocol.  It provides
>a standardized API for easy application portability and a standarized
>token framing.  It can be integrated into many different existing
>communication protocols.  The gssapi framing will automatically interoperate,
>the different application protocols will most probably not.
>
>Availability of public key based implementations is probably the
>major issue in the case of LDAP.   There are a lot more SSL implementations
>available and deployed than there are SPKM implementations.  And they
>come with a completely defined on-the-wire protocol.
>
>-Martin
>

I was not trying to argue an SSL vs GSS issue.  I was basing my response
off of Mike's comment: "There are far too many groups that are inventing
their own
authentication and security negotation mechanisms".

I put forth SASL as an example, and I used LDAP as an example of another
group adopting it.

--Matt

---

From: "Theodore Y. Ts'o" <[email-masked]>
Date: Sat, 15 Nov 1997 20:20:10 -0500

Date: Fri, 07 Nov 1997 14:53:43 -0800
   From: Matt Hur <[email-masked]>

   I was not trying to argue an SSL vs GSS issue.  I was basing my
   response off of Mike's comment: "There are far too many groups that
   are inventing their own authentication and security negotation
   mechanisms".

But SASL can also be viewed as perfectly appropriate way of framming
GSSAPI tokens and inserting them into a line-oriented application
protocol.  When viewed in this light, there's nothing wrong with it; it
is providing a "value-added" layer above the GSSAPI library/mechanism.  

Yes, I know SASL can also be used to handle non-GSSAPI mechanisms; most
notably Kerberos V4, which is probably due to the fact that no-one ever
released a fully-functioning Kerberos V4 GSSAPI mechanism.

						- Ted