Subject: RE: SPNEGO-bis: a summary of discussions at the DC and changes since -00

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Mon, 22 Nov 2004 09:42:05 -0800

> Larry Zhu wrote:
 > 1) The support of security mechanisms that do not support integrity 
> services is back.

This was actually left unspecified in the draft submitted.

-- Larry

-----Original Message-----
From: Jeffrey Altman [mailto:[email-masked]] 
Sent: Monday, November 22, 2004 6:21 AM
To: Liqiang(Larry) Zhu
Cc: [email-masked]
Subject: Re: SPNEGO-bis: a summary of discussions at the DC and changes
since -00

Liqiang(Larry) Zhu wrote:
> The updated version was submitted, and it was based on discussions we 
> had at IETF61.
> 
> 
> The following is a summary of major changes since -00.  This is also 
> the summary of the discussions among Sam, Wyllys, Nico, Jeff, me and 
> others at the Washington DC.
> 
> 1) The support of security mechanisms that do not support integrity 
> services is back.

Although this decision has not been validated on the list yet, according
to the minutes of the IETF 61 meeting there was a strong preference to
maintain the MUST NOT restriction on the use of security mechanisms
without integrity protection.

I will also point out that no consensus has yet been reached on whether
the use of an optimistic token in SPNEGO will be SHOULD or MAY in the
document.

I will be issuing a CALL FOR CONSENSUS on these issues and other
decisions from IETF 61 later today.

Jeffrey Altman

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: "Liqiang\(Larry\) Zhu" <[email-masked]>
Date: Mon, 22 Nov 2004 18:41:48 -0800

I talked with Luke off-list about this, we might not have issues at all
here but we definitely need some clarifications with all the inner and
outer tags and lengths, and how to describe them unambiguously.

Thanks,

-- Larry

-----Original Message-----
From: Luke Howard [mailto:[email-masked]] 
Sent: Monday, November 22, 2004 4:20 AM
To: Liqiang(Larry) Zhu
Cc: [email-masked]; [email-masked]
Subject: Re: SPNEGO-bis: a summary of discussions at the DC and changes
since -00

>9) The computation of mechlistMIC is further clarified.

What was the rationale for not including the tag and length of the
encoded MechTypeList as input to GSS_GetMIC()?

I ask only as Heimdal presently does include the tag and length when
computing the mechlistMIC. I would be interested to know if you surveyed
other implementations.

-- Luke

--