Subject: Please consider forward motion on PRF and mechanism attributes

From: Sam Hartman <[email-masked]>
Date: Mon, 11 Apr 2005 18:21:24 -0400

Hi.  I'd like to ask the working group to consider trying to move
forward the PRF drafts rapidly.  In addition, while I don't think we
are close to being in a position to know what mechanism attributes we
want, I'd love to have consensus on the APIs for accessing mechanism
attributes.

Having forward progress on these items may end up helping a proposal
Joe Salowey is working on.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 11 Apr 2005 17:51:14 -0500

> Joe Salowey is working on.

As far as I'm concerned the I-Ds are ready for WG LC.

That said, we may want to remove the restriction that the krb5 GSS_Prf()
cannot be ready prior to full context establishment.  Applications that
use GSS_Prf() can certainly ensure that they call it in synchronized
fashion before OR after full context establishment.  I mention this ONLY
as a result of your other post today about negotiation and composite
mechanisms -- having GSS_Prf() prior to full context establishment could
help construct stackable pseudo-mechanisms that protect against
manipulation of its context tokens into those of underlying mechanisms'.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 11 Apr 2005 18:39:31 -0500

> manipulation of its context tokens into those of underlying mechanisms'.

Er, disregard that suggestion -- there's never a partially established
security context for the Kerbers V GSS mechanism on the acceptor side...