Subject: rfc2222bis: re-negotiating SASL security layer

From: Hallvard B Furuseth <[email-masked]>
Date: Wed, 15 Oct 2003 13:31:17 +0200

rfc2222bis section 6.3 "Multiple authentications" says:

   If a security layer is in effect
   and a subsequent SASL negotiation selects a second security layer,
   then the second security layer replaces the first. If a security
   layer is in effect and a subsequent SASL negotiation selects no
   security layer, the original security layer must be removed.

Exactly when is the old layer canceled?

If an old layer is active and the client starts to negotiate a new
layer, it may not know when to expect the response from the server.
So the layer can't be canceled by starting a new negotiation.

It could be canceled after receipt of the first response from the
server.  Or after the completed SASL negotiation, which would be
performed with the old layer in effect.  I don't know how easy that
would be to implement, or if it would interfere with the definitions of
some SASL mechanisms to have two mechanisms active at the same time.

Another way would for the layers themselves contain a 'cancel layer'
operation, which may only be used just before negotiating a new layer
and before closing the connection.  Then the SASL negotiation could be
performed without mixing the old and the new SASL mechanism, and the
layer could only be re-negotiated if the old layer had such a 'cancel
layer' operation.

-- 
Hallvard