Nicolas Williams <Nicolas(_dot_)Williams(_at_)sun(_dot_)com> writes:
In particular, the current consensus of the SASL community appears to
be that SASL "security layers" (i.e., confidentiality and integrity
protection of application data after authentication) are too complex
and, since SASL applications tend to have an option to run over a
Transport Layer Security (TLS) [RFC5246] channel, redundant and best
replaced with channel binding.
Spencer (nit): it's a LONG way from "too complex" to "redundant" in this
sentence ;-) suggest moving "redundant" before the subclause, just for
readability.
Good point. The "and best replaced with channel binding" can be a
separate sentence too ("Use of SASL security layers is best replaced
with channel binding to a TLS channel.").
I've made this change too.
16. Security Considerations
GS2 does not directly use any cryptographic algorithms, therefore it
is automatically "algorithm agile", or, as agile as the GSS-API
mechanisms that are available for use in SASL applications via GS2.
The exception is the use of SHA-1 for deriving SASL mechanism names,
but no cryptographic properties are required. The required property
Spencer (nit): I would suggest "SHA-1 is used to derive SASL mechanism
names, but no cryptographic properties are required" - the current text
says "we don't use crypto, except when we do" :-)
:)
How about:
GS2 does not directly use any cryptographic algorithms for security
features, therefore it is automatically "algorithm agile", ...
GS2 does use SHA-1 for deriving SASL mechanism names from GSS-API
mechanism OIDs, but this use of SHA-1 is not security-relevant.
Thanks!
I used the slightly more verbose:
SHA-1 is used to derive SASL mechanism names, but no traditional
cryptographic properties are required -- the required property is
that the truncated output for distinct inputs are different for
practical input values. GS2 does not use any other cryptographic
algorithm. Therefor GS2 is "algorithm agile", or, as agile as the
GSS-API mechanisms that are available for use in SASL applications
via GS2.
/Simon
_______________________________________________
Ietf mailing list
Ietf(_at_)ietf(_dot_)org
https://www.ietf.org/mailman/listinfo/ietf