Subject: [nfsv4] NFSv4 & IPsec channel binding Re: [FWD: New Version Notification for draft-williams-ipsec-channel-binding-00]

From: Nicolas Williams <[email-masked]>
Date: Mon, 21 Apr 2008 15:54:50 -0500

I've submitted a new version of draft-williams-ipsec-channel-binding,
-01.

The primary change here is this: rather than use the raw public keys I
want to use a hash of them.  The main reason is: so keeping channel
binding data in kernel mode implementations is not too difficult (by
reducing the size of the data to keep around).  Hash agility is pushed
to the application, which will require a change to RPCSEC_GSSv2 (which
is still an I-D and has not progressed yet).

I've also submitted draft-williams-ipsec-unique-channel-binding-00.txt.
This doc specifies how to get unique channel bindings for IPsec.  I had
thought this wouldn't be possible.  I was wrong.

I propose that RPCSEC_GSSv2 be modified so that RPCSEC_GSS_BIND_CHANNEL
can carry in cleartext the channel binding type prefix.  I also propose
that we add another procedure to RPCSEC_GSSv2 by which clients can ask
what channel binding types the server supports.

Finally, I've submitted -07 of draft-ietf-btns-connection-latching.  I
think this is ready for a WGLC in the BTNS WG.

Nico
-- 
_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4