Subject: Re: SCRAM with(out) GS2

From: Simon Josefsson <[email-masked]>
Date: Wed, 27 Feb 2008 13:22:52 +0100

Nicolas Williams <[email-masked]> writes:

> Thus I am strongly in favor of at least adding the channel-binding-only
> option to GS2.  I am also leaning towards being in favor of removing
> support for security layers and security layer negotiation from GS2 as
> well -- that would another significant simplification.  On the latter
> point I'd like to hear from Simon and others whether they are OK with
> GS2 (GS3, whatever) mechanisms not providing any security layers.

I am.  My use case has always been to use GS2 with TLS and channel
bindings.  With Kerberos 5 for optimized round-trips, and with a
password-based GSS-API mechanism for wide use.

I don't see what has to be _added_ to GS2 support this though?

/Simon

---

From: Simon Josefsson <[email-masked]>
Date: Wed, 27 Feb 2008 13:19:16 +0100

Chris Newman <[email-masked]> writes:

> As a SASL implementer, it is my current intention to not implement the
> "security layer" feature of SASL.

For the record, I agree and think that the "security layer" of SASL has
been a failure and the time has come to officially deprecate them.

We could update RFC 4422 to say that security layers are deprecated in
favor of channel-binding to another security layer such as TLS or IPSEC.

/Simon