Subject: Re: [nfsv4] NFSv4 & IPsec channel binding Re: [FWD: New Version Notification for draft-williams-ipsec-channel-binding-00]

From: "Mike Eisler" <[email-masked]>
Date: Fri, 23 May 2008 17:15:35 -0700 (PDT)

On Mon, April 21, 2008 1:54 pm, Nicolas Williams wrote:
> I've submitted a new version of draft-williams-ipsec-channel-binding,
> -01.
>
> The primary change here is this: rather than use the raw public keys I
> want to use a hash of them.  The main reason is: so keeping channel
> binding data in kernel mode implementations is not too difficult (by
> reducing the size of the data to keep around).  Hash agility is pushed
> to the application, which will require a change to RPCSEC_GSSv2 (which
> is still an I-D and has not progressed yet).

A new draft  of RPCSEC_GSSv2 was posted today that reflects this change.

> I've also submitted draft-williams-ipsec-unique-channel-binding-00.txt.
> This doc specifies how to get unique channel bindings for IPsec.  I had
> thought this wouldn't be possible.  I was wrong.
>
> I propose that RPCSEC_GSSv2 be modified so that RPCSEC_GSS_BIND_CHANNEL
> can carry in cleartext the channel binding type prefix.  I also propose
> that we add another procedure to RPCSEC_GSSv2 by which clients can ask
> what channel binding types the server supports.

The aforementioned new draft carries both the channel binding
prefix and the OID of the channel bindings hash algorithm.

Instead of an additional procedure, the results of RPCSEC_GSS_BIND_CHANNEL
will indicate if the target did not accept the channel bindings
prefix or the hash algorithm. This way, a client needs no more than
two round trips if the prefix or hash is unacceptable.

If I don't get any comments in a few days, I will request a WG
Last Call.

>
> Finally, I've submitted -07 of draft-ietf-btns-connection-latching.  I
> think this is ready for a WGLC in the BTNS WG.
>
> Nico
> --
> _______________________________________________
> nfsv4 mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/nfsv4
>

-- 
Mike Eisler, Senior Technical Director, NetApp, 719 599 9026,
http://blogs.netapp.com/eislers_nfs_blog/

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/nfsv4