Subject: RE: SASL security layers

From: Paul Leach <[email-masked]>
Date: Mon, 12 Oct 1998 21:36:54 -0700

Does the "buffer" include the security mechanism's trailer, or not?

> -----Original Message-----
> From: Chris Newman [mailto:[email-masked]]
> Sent: Monday, October 12, 1998 11:35 AM
> To: Paul Leach
> Cc: [email-masked]'
> Subject: Re: SASL security layers
> 
> 
> On Fri, 9 Oct 1998, Paul Leach wrote:
> > When applied to GSS mechanisms, the following issue arises. 
> My data stream
> > looks like this:
> > 
> > 	4 byte count
> > 	App protocol data unit (APDU)
> > 	padding to cipher block size
> > 	GSS mechanism trailer
> 
> SASL only specifies that the cipher text buffers begin with a 4-octet
> count (covering the remainder of the buffer).  The structure 
> of the cipher
> text buffers is otherwise entirely defined by the mechanism.
> 
> If you're using the GSSAPI SASL mechanism, the buffer consists of the 
> entire output of a GSS_Wrap operation, with a SASL 
> security-layer buffer
> length prepended.
> 
> 		- Chris
> 
>

---

From: Chris Newman <[email-masked]>
Date: Tue, 13 Oct 1998 10:19:54 -0700 (PDT)

> Does the "buffer" include the security mechanism's trailer, or not?

A SASL security layer is a stream of blocks, each with a four-byte length.
The concept of a "trailer" isn't part of SASL, so it would be part of the
buffer.

The basic idea is that the blocking & buffering code is completely
independent of the mechanism used.

		- Chris

---

From: Chris Newman <[email-masked]>
Date: Tue, 13 Oct 1998 10:19:54 -0700 (PDT)

- Chris