Subject: [anonsec] Much ado about little?

From: Black_David at emc.com ([email-masked])
Date: Wed Nov 24 09:34:53 2004

Joe,

> One argument for dealing with channel bindings is to handle an API 
> issue; APIs are being dealt with in KITTEN, not in PKI4IPSEC.

To be specific, KITTEN is dealing with exactly two versions (v2 &
v3) of GSSAPI; any API other than GSSAPI is out of scope.  Putting
channel bindings into KITTEN amounts to assuming that channel
bindings require GSSAPI, as the references to channel bindings in
KITTEN's charter are solely within the context of GSSAPI v3.  That
approach is not going to produce useful results for the IP Storage
(ips) protocols because those authentication frameworks are not
GSSAPI and converting them to GSSAPI just to get channel bindings
cannot be justified.

Besides, channel bindings are not an API issue - while an API is
needed to get them from IPsec to the higher layer protocol, it's
not necessary to specify that API.  What is necessary is to 
specify the content of the information that is to be bound to,
and let implementers worry about how to pass it around.

Thanks,
--David
----------------------------------------------------
David L. Black, Senior Technologist
EMC Corporation, 176 South St., Hopkinton, MA  01748
+1 (508) 293-7953             FAX: +1 (508) 293-7786
[email-masked]        Mobile: +1 (978) 394-7754
----------------------------------------------------