Subject: [kitten] I-D Action: draft-ietf-kitten-gss-loop-00.txt

From: [email-masked]
Date: Sat, 10 May 2014 22:27:46 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Common Authentication Technology Next Generation Working Group of the IETF.

        Title           : Structure of the GSS Negotiation Loop
        Author          : Benjamin Kaduk
	Filename        : draft-ietf-kitten-gss-loop-00.txt
	Pages           : 17
	Date            : 2014-05-08

Abstract:
   This document specifies the generic structure of the negotiation loop
   to establish a GSS security context between initiator and acceptor.
   The control flow of the loop is indicated for both parties, including
   error conditions, and indications are given for where application-
   specific behavior must be specified.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-kitten-gss-loop/

There's also a htmlized version available at:
http://tools.ietf.org/html/draft-ietf-kitten-gss-loop-00

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Benjamin Kaduk <[email-masked]>
Date: Fri, 23 May 2014 16:30:41 -0400 (EDT)

> http://tools.ietf.org/html/draft-ietf-kitten-gss-loop-00

The only changes of note are in the C sample code.
The controversial comment about "safe to call gss_release_buffer twice on 
the same buffer" is removed, and the behavior changed slightly.  Inside 
the loop, the buffer is always released, which is safe.  Since 
gss_release_buffer is required to zero the length field, that is what is 
checked in the outer cleanup label to avoid calling gss_release_buffer 
twice.  I also made some style tweaks, inspired by Greg's comments, and 
changed the name of the "context_established" variable to reflect which 
side of the exchange was established.  I did not take Nico's suggestion of 
adding in a check in the acceptor for whether the authenticated initiator 
name was authorized, as that would be a fair amount of extra code and 
probably be mission creep.

-Ben