Subject: Re: I-D Action:draft-ietf-sasl-channel-bindings-00.txt

From: Alexey Melnikov <[email-masked]>
Date: Sat, 23 May 2009 13:12:28 +0100

Simon Josefsson wrote:

>Kurt Zeilenga <[email-masked]> writes:
>  
>
>>On Apr 13, 2009, at 2:19 PM, Nicolas Williams wrote:
>>    
>>
>>>On Mon, Apr 13, 2009 at 02:03:47PM -0700, Kurt Zeilenga wrote:
>>>      
>>>
>>>>I generally do not favor changing RFC 4422 as discussed in this I-D.
>>>>
>>>>My view is that while GS2 mechanisms (such as SCRAM) handle channel
>>>>in
>>>>similar ways (by design), we should not impose any restriction that
>>>>other mechanisms which support channel bindings do so in a like way.
>>>>
>>>>For instance, many of the suggested restrictions make little sense
>>>>for
>>>>YAP.  Nor would they necessarily make sense for a "channel-bound"
>>>>EXTERNAL mechanism (which, BTW, I have in the works).
>>>>        
>>>>
>>>Can you elaborate?  Also, EXTERNAL is just not an issue.
>>>      
>>>
>>Basically, there is a desire for a client to state from which lower-
>>level it wishes to pull up an identity from.  So, my idea is to use
>>unique channel bindings to specify which lower-level.  This use of
>>channel binding is not intended to add any security protection, just
>>as a convenient means to uniquely identify a channel.
>>    
>>
>That is already described in:
>
>http://tools.ietf.org/html/draft-josefsson-sasl-external-channel-00
>
>There were comments that said transferring the actual channel binding
>data is pointless, so I'll remove that part and resubmit as -01.
>  
>
I think in short term we will have bugs due to introduction of channel 
bindings, so I think having this information in authentication exchange 
would help with debugging problems.

---

From: Simon Josefsson <[email-masked]>
Date: Mon, 25 May 2009 14:05:47 +0200

Alexey Melnikov <[email-masked]> writes:

> bindings, so I think having this information in authentication
> exchange would help with debugging problems.

I agree with that, but supporting a field in the protocol just for
debugging purposes seems to offer a low benefit to cost ratio.  It isn't
that difficult to debug channel binding problems using other methods.

/Simon

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 25 May 2009 13:52:35 -0500

> that difficult to debug channel binding problems using other methods.

I agree.