Subject: Re: Pluggable GSSAPI

From: Jeffrey Altman <[email-masked]>
Date: Tue, 01 May 2007 07:58:37 -0400

As former chair of this working group I am going to offer the following
opinion.  Incremental modifications to GSSAPIv2 are not going to provide
a satisfying solution.  GSSAPIv2 programming is already too confusing
for the vast majority of developers.  Modifying the semantics of the API
such that if X & Y & Z are true then it behaves like v2.5 but otherwise
behaves like v2.0 is simply going to be too difficult to learn but more
importantly, it will too hard for a developer to determine if the
correct set of pieces are available.

This thread has raised some very interesting ideas that could be used to
improve the usability of the GSSAPI while maintaining a compatible wire
protocol.  I strongly suggest you focus on developing GSSAPIv3 and do so
in such a manner that minimizes the amount of work necessary for a
mechanism developer to support both GSSAPIv2 and GSSAPIv3 within the
same module.

Jeffrey Altman
Secure Endpoints Inc.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 1 May 2007 10:37:27 -0500

> correct set of pieces are available.

I'm not so sure.  The best part about incremental changes is that it's
easier to get them deployed and used.

It's all about trade-offs.