Subject: RE: SPNEGO-bis: a summary of discussions at the DC and changes since

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Mon, 22 Nov 2004 16:15:03 -0800

Martin Rex wrote:
> My clear preference is to stick with MAY, as in the original SPNEGO
spec.

Most of people who have spoken either on the list or at the DC preferred
a "SHOULD". You did not provide convincing arguments for a "MAY".  If
your sole purpose to use a "MAY" is to test applications and break bad
ones, a "SHOULD" here is sufficient.

The consensus seemed clearly to be a "SHOULD", not a "MAY" in this case.

-- Larry

-----Original Message-----
From: Martin Rex [mailto:[email-masked]] 
Sent: Monday, November 22, 2004 1:50 PM
To: Jeffrey Altman
Cc: Liqiang(Larry) Zhu; [email-masked]
Subject: Re: SPNEGO-bis: a summary of discussions at the DC and changes
since

Jeffrey Altman wrote:
> 
> Although this decision has not been validated on the list yet, 
> according to the minutes of the IETF 61 meeting there was a strong 
> preference to maintain the MUST NOT restriction on the use of security

> mechanisms without integrity protection.

... MUST NOT ... without ...
I'm not sure I understand.

Keep in mind that base GSS-API does not have a MUST support integrity
protection, so a requirement in SPNEGO would exclude those mechanisms
entirely from negotiation.

Personally, I think the warning in the security considerations that the
absense of integrity protection on any single mechanism of the clients
mechanism list makes the handshake vulnerable to a downgrade attack
should be sufficient.

> 
> I will also point out that no consensus has yet been reached on 
> whether the use of an optimistic token in SPNEGO will be SHOULD or MAY

> in the document.

My clear preference is to stick with MAY, as in the original SPNEGO
spec.

-Martin

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten