Re: Gen-ART review of draft-ietf-sasl-gs2-18

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Nicolas Williams wrote:

On Thu, Dec 03, 2009 at 07:02:53PM +0000, Alexey Melnikov wrote:
Hi Nico,

Nicolas Williams wrote:
13.3.  Additional Recommendations

If the application requires security layers then it MUST prefer the
SASL "GSSAPI" mechanism over "GS2-KRB5" or "GS2-KRB5-PLUS".

Spencer (minor): If "prefer the mechanism" is the right way to describe this, I apologize, but I don't know what the MUST means in practice - if this needs to be at MUST strength, I'd expect text like "MUST use X and MUST NOT use Y or Z", or "MUST use X unless the server doesn't support X".
Agreed, we should express a MUST NOT instead of a MUST:

If a SASL application requires security layers then it MUST NOT use
GS2 mechanisms.  Such an application SHOULD use a SASL mechanism that
does provide security layers, such as GS1 mechanisms.
There is no such thing as GS1, it should be GSSAPI. Otherwise the new text is Ok.
The I-D says:

                                                           The original
  GSS-API->SASL mechanism bridge was specified by [RFC2222], now
  [RFC4752]; we shall sometimes refer to the original bridge as GS1 in
  this document.

I don't see anything wrong with that.

Very well. I forgot about that.

There's good reason, even, to want to use "GS1" to refer to RFC4572:
RFC2222/4572's use of "GSSAPI" to refer to the "Kerberos V5 GSS-API
mechanism" is wrong and confusing.  Avoiding confusion is a good thing.
Personally I dislike unnecessary indirection, as it allows for extra confusion as well. There is only 1 mechanism in GS1 family (ignoring GSS-SPNEGO), it is called "GSSAPI". So I think the original text is actually better, if we add a reference and change "prefer" to "use":

 If the application requires SASL security layers then it MUST use the
 SASL "GSSAPI" mechanism [RFC4572] instead of "GS2-KRB5" or "GS2-KRB5-PLUS".

Opinions?


_______________________________________________
Ietf mailing list
Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf

[Index of Archives]     [IETF Annoucements]     [IETF]     [IP Storage]     [Yosemite News]     [Linux SCTP]     [Linux Newbies]     [Fedora Users]