Subject: Protocol Action: The Simple and Protected GSS-API Negotiation Mechanism to Proposed Standard

From: The IESG <[email-masked]>
Date: Wed, 11 Nov 1998 07:13:08 -0500

The IESG has approved the Internet-Draft 'The Simple and Protected
GSS-API Negotiation Mechanism' <draft-ietf-cat-snego-09.txt> as a
Proposed Standard.  This document is the product of the Common
Authentication Technology Working Group.  The IESG contact persons are
Jeffrey Schiller and Marcus Leech.

Technical Summary
 
The Generic Security Service API (GSS-API) provides a common API for
using several authentication technologies. Originally conceived as a
way for programmers to structure their programs so that it can be
linked to work with any conformant GSS-API "mechanism." However the
API and its implementations have evolved to the point where several
mechanisms might be linked in a given application. What remains is a
facility to negotiate which among potentially several mechanisms
should be used between a particular client and a particular
server. This document defines the Security Negotiation Mechanism
(SNEGO) which is appropriate for applications which use the GSS-API.

Working Group Summary

There was clear consensus on this draft.

Protocol Quality

This document was reviewed by Jeffrey I. Schiller for the IESG. An
important subtlety, where security mechanisms are being negotiated, is
to ensure that an intruder cannot compromise the negotiation and force
the use of a particular (weak) mechanism. The SNEGO protocol guards
against this attack (as much as it can be guarded).