Subject: Re: [abfab] MIC on extension token

From: Luke Howard <[email-masked]>
Date: Wed, 29 Jun 2011 10:15:15 +0000

Any progress on this?

-- Luke

On 31/05/2011, at 9:13 PM, Luke Howard wrote:

> 
> On 31/05/2011, at 10:57 AM, Sam Hartman wrote:
> 
>>>>>>> "Luke" == Luke Howard <[email-masked]> writes:
>> 
>>   Luke> Instead I propose (well, Sam proposes and I implemented) the
>>   Luke> following. On the initiator extension token leg (the last
>>   Luke> token from the initiator), a MIC is sent of the mechanism OID
>>   Luke> and the extension tokens, excluding the MIC token. The
>>   Luke> acceptor verifies it and generates a MIC of its extension
>>   Luke> token to send to the initiator. The initiator verifies this.
>> 
>>   Luke> This gives us protection of all extension tokens sent in the
>>   Luke> last round trip.
>> 
>> I'd like to hear comments on this.  Unless we hear objections or the
>> editors receive different instructinos from the chairs, we will make
>> this so in the next version of the gss-eap draft.
> 
> 
> +1 from me.
> 
> -- Luke
> _______________________________________________
> abfab mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/abfab

--
Luke Howard / [email-masked]
www.padl.com / www.lukehoward.com

---

From: Sam Hartman <[email-masked]>
Date: Wed, 29 Jun 2011 09:17:59 -0400

>>>>> "Luke" == Luke Howard <[email-masked]> writes:

    Luke> Any progress on this?

Yes.  I just spent this morning going through your code and deriving my
understanding of what gets spit out and am starting to write it up.  I
understand you've written things down in e-mail; I have that mail and
will go back and check against it.  However I thought it would be good
to have an independent analysis so when you read my write-up you can see
if my understanding matches what you expect.