Nicolas Williams <Nicolas.Williams@xxxxxxx> writes:
>> In particular, the current consensus of the SASL community appears to
>> be that SASL "security layers" (i.e., confidentiality and integrity
>> protection of application data after authentication) are too complex
>> and, since SASL applications tend to have an option to run over a
>> Transport Layer Security (TLS) [RFC5246] channel, redundant and best
>> replaced with channel binding.
>>
>> Spencer (nit): it's a LONG way from "too complex" to "redundant" in this
>> sentence ;-) suggest moving "redundant" before the subclause, just for
>> readability.
>
> Good point. The "and best replaced with channel binding" can be a
> separate sentence too ("Use of SASL security layers is best replaced
> with channel binding to a TLS channel.").
I've made this change too.
>> 16. Security Considerations
>>
>> GS2 does not directly use any cryptographic algorithms, therefore it
>> is automatically "algorithm agile", or, as agile as the GSS-API
>> mechanisms that are available for use in SASL applications via GS2.
>> The exception is the use of SHA-1 for deriving SASL mechanism names,
>> but no cryptographic properties are required. The required property
>>
>> Spencer (nit): I would suggest "SHA-1 is used to derive SASL mechanism
>> names, but no cryptographic properties are required" - the current text
>> says "we don't use crypto, except when we do" :-)
>
> :)
>
> How about:
>
> GS2 does not directly use any cryptographic algorithms for security
> features, therefore it is automatically "algorithm agile", ...
>
> GS2 does use SHA-1 for deriving SASL mechanism names from GSS-API
> mechanism OIDs, but this use of SHA-1 is not security-relevant.
>
> Thanks!
I used the slightly more verbose:
SHA-1 is used to derive SASL mechanism names, but no traditional
cryptographic properties are required -- the required property is
that the truncated output for distinct inputs are different for
practical input values. GS2 does not use any other cryptographic
algorithm. Therefor GS2 is "algorithm agile", or, as agile as the
GSS-API mechanisms that are available for use in SASL applications
via GS2.
/Simon
_______________________________________________
Ietf mailing list
Ietf@xxxxxxxx
https://www.ietf.org/mailman/listinfo/ietf