Subject: Protecting the mech negotiation in GS2

From: Nicolas Williams <[email-masked]>
Date: Thu, 9 Apr 2009 11:25:09 -0500

I proposed a while back that we could protect the server's mech list in
GS2.  That saves a round-trip for applications that want to protect the
mechanism negotiation.  As such it seems worth doing, and the change for
it is very small:

a) add a flag to the GS2 initial auth message header indicating whether
   the server mech list is being protected, and

b) add the server mech list to the GS2 channel binding data header.

The impact on SASL APIs should be none beyond the impact of channel
binding and the negotiation of channel binding in the first place.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 10 Apr 2009 13:19:42 -0500

Never mind -- if one is doing channel binding (and one should be) then
the mechanism negotiation is protected implicitly.  And if not, well,
since the new mechanisms don't have sec layers there's not much point in
protecting the negotiation.

Nico
--