From owner-ietf-cat-wg@lists.Stanford.EDU  Thu May 10 14:49:31 2001
Received: from lists.Stanford.EDU ([171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id OAA06129
	for <cat-archive@odin.ietf.org>; Thu, 10 May 2001 14:49:30 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4AI2iv20351
	for ietf-cat-wg-out720680; Thu, 10 May 2001 11:02:44 -0700 (PDT)
Received: from dns2.anl.gov (dns2.anl.gov [146.139.254.3])
	by lists.Stanford.EDU (8.11.3/8.11.3) with ESMTP id f4AI2cA20343
	for <ietf-cat-wg@lists.Stanford.EDU>; Thu, 10 May 2001 11:02:38 -0700 (PDT)
Received: from anl.gov (atalanta.ctd.anl.gov [146.137.64.60])
	by dns2.anl.gov (8.9.1a/8.9.1) with ESMTP id NAA17724;
	Thu, 10 May 2001 13:02:17 -0500 (CDT)
Message-ID: <3AFAD821.BC8818C9@anl.gov>
Date: Thu, 10 May 2001 13:04:17 -0500
From: "Douglas E. Engert" <deengert@anl.gov>
X-Mailer: Mozilla 4.76 [en] (Windows NT 5.0; U)
X-Accept-Language: en
MIME-Version: 1.0
To: "Linn, John" <jlinn@rsasecurity.com>
CC: "'ietf-krb-wg@anl.gov'" <ietf-krb-wg@anl.gov>,
        "'CAT-WG List'" <ietf-cat-wg@lists.Stanford.EDU>
Subject: Re: Soliciting additional GSS/Kerberos interoperability results
References: <F504A8CEE925D411AF4A00508B8BE90A93E5A8@exna07.securitydynamics.com>
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk
Content-Transfer-Encoding: 7bit



"Linn, John" wrote:
> 
> Kerberos WG:
> 
> This will be familiar news for those also subscribing to the CAT-WG mailing
> list, but I'd like to point out to others in the Kerberos community that
> we're looking for interoperability testing results which could support
> advancement of the GSS-API RFCs (2743, and 2744 and/or 2853) to Draft
> Standards.  We've some results already reported, but could use more.

If its 2743 and 2744 you would like to move along, then you must also be interested
 in GSS mechanisms other then Kerberos and how they could be written to use these 
RFCs. The Globus GSI  which implements a GSS using PKI and SSL is one example.
See: http://www.globus.org 

As we pointed out at the last IETF, we wished that there where a few additions
to the RFCs, but did not find any problems with the current RFCs themselves. 

As an interoperability example, the Globus applications (including ssh and ftp) are
written to work with either the GSI or the Kerberos mechanisms. This choice can be made
at link time. When using the ssh client, SecureCRT, on Windows, the choice can be made
at run time via a DLL. (If the mechglue was working for UNIX, UNIX could make the choice
at run time too.) 

So I would say that these RFCs are in good shape, and could move forward. 

> Recognizing that several Kerberos-based GSS implementations exist, I'd like
> to solicit any summaries which their keepers can provide concerning the
> scope of testing undertaken, other implementations that have been tested
> against, and particularly the sets of GSS-selectable features which were
> exercised in testing.  Please send any results you can offer either to the
> CAT-WG list at ietf-cat-wg@lists.stanford.edu, or to me as CAT-WG chair.
> Thanks for any support you can provide in this effort.
> 
> --jl

-- 

 Douglas E. Engert  <DEEngert@anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


From owner-ietf-cat-wg@lists.Stanford.EDU  Fri May 11 00:06:18 2001
Received: from lists.Stanford.EDU ([171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id AAA15778
	for <cat-archive@odin.ietf.org>; Fri, 11 May 2001 00:06:17 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4B3C2a01823
	for ietf-cat-wg-out720680; Thu, 10 May 2001 20:12:02 -0700 (PDT)
Received: from mail3.microsoft.com (mail3.microsoft.com [131.107.3.123])
	by lists.Stanford.EDU (8.11.3/8.11.3) with SMTP id f4B3C1A01818
	for <ietf-cat-wg@lists.stanford.edu>; Thu, 10 May 2001 20:12:01 -0700 (PDT)
Received: from 157.54.9.104 by mail3.microsoft.com (InterScan E-Mail VirusWall NT); Thu, 10 May 2001 11:25:32 -0700 (Pacific Daylight Time)
Received: from red-imc-02.redmond.corp.microsoft.com ([157.54.9.107]) by inet-imc-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.2883);
	 Thu, 10 May 2001 11:26:24 -0700
Received: from win-imc-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by red-imc-02.redmond.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.2883);
	 Thu, 10 May 2001 11:26:22 -0700
Received: from win-msg-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.52]) by win-imc-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(5.0.2195.1600);
	 Thu, 10 May 2001 11:26:22 -0700
X-MimeOLE: Produced By Microsoft Exchange V6.0.4688.0
content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Subject: RE: Soliciting additional GSS/Kerberos interoperability results
Date: Thu, 10 May 2001 11:26:21 -0700
Message-ID: <4AEE3169443CDD4796CA8A00B02191CDD32BE9@win-msg-01.wingroup.windeploy.ntdev.microsoft.com>
Thread-Topic: Soliciting additional GSS/Kerberos interoperability results
Thread-Index: AcDZfIg5Hd+0ZLblQVeVHJar35yfiAAAdj/w
From: "John Brezak" <jbrezak@windows.microsoft.com>
To: "Douglas E. Engert" <deengert@anl.gov>,
        "Linn, John" <jlinn@rsasecurity.com>
Cc: <ietf-krb-wg@anl.gov>, "CAT-WG List" <ietf-cat-wg@lists.Stanford.EDU>
X-OriginalArrivalTime: 10 May 2001 18:26:22.0171 (UTC) FILETIME=[B6C2F2B0:01C0D97E]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by lists.Stanford.EDU id f4B3C2A01819
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk
Content-Transfer-Encoding: 8bit

There appears to be an issue with gss_canonicalize_name when used with
Kerberos. If a middle tier server has multiple principals (as is
currently the case with Kerberos), how can gss_canonicalize name be used
in its described way for building a canonical name for that middle-tier
server that can be stored on ACLs?

-----Original Message-----
From: Douglas E. Engert [mailto:deengert@anl.gov] 
Sent: Thursday, May 10, 2001 11:04 AM
To: Linn, John
Cc: 'ietf-krb-wg@anl.gov'; 'CAT-WG List'
Subject: Re: Soliciting additional GSS/Kerberos interoperability results




"Linn, John" wrote:
> 
> Kerberos WG:
> 
> This will be familiar news for those also subscribing to the CAT-WG 
> mailing list, but I'd like to point out to others in the Kerberos 
> community that we're looking for interoperability testing results 
> which could support advancement of the GSS-API RFCs (2743, and 2744 
> and/or 2853) to Draft Standards.  We've some results already reported,

> but could use more.

If its 2743 and 2744 you would like to move along, then you must also be
interested  in GSS mechanisms other then Kerberos and how they could be
written to use these 
RFCs. The Globus GSI  which implements a GSS using PKI and SSL is one
example.
See: http://www.globus.org 

As we pointed out at the last IETF, we wished that there where a few
additions to the RFCs, but did not find any problems with the current
RFCs themselves. 

As an interoperability example, the Globus applications (including ssh
and ftp) are written to work with either the GSI or the Kerberos
mechanisms. This choice can be made at link time. When using the ssh
client, SecureCRT, on Windows, the choice can be made at run time via a
DLL. (If the mechglue was working for UNIX, UNIX could make the choice
at run time too.) 

So I would say that these RFCs are in good shape, and could move
forward. 

> Recognizing that several Kerberos-based GSS implementations exist, I'd

> like to solicit any summaries which their keepers can provide 
> concerning the scope of testing undertaken, other implementations that

> have been tested against, and particularly the sets of GSS-selectable 
> features which were exercised in testing.  Please send any results you

> can offer either to the CAT-WG list at ietf-cat-wg@lists.stanford.edu,

> or to me as CAT-WG chair. Thanks for any support you can provide in 
> this effort.
> 
> --jl

-- 

 Douglas E. Engert  <DEEngert@anl.gov>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


From owner-ietf-cat-wg@lists.Stanford.EDU  Sun May 13 20:10:15 2001
Received: from lists.Stanford.EDU ([171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id UAA15483
	for <cat-archive@odin.ietf.org>; Sun, 13 May 2001 20:10:14 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4DNRtv18905
	for ietf-cat-wg-out720680; Sun, 13 May 2001 16:27:55 -0700 (PDT)
Received: from fort-point-station.mit.edu (FORT-POINT-STATION.MIT.EDU [18.72.0.53])
	by lists.Stanford.EDU (8.11.3/8.11.3) with ESMTP id f4DNRrA18900
	for <ietf-cat-wg@lists.stanford.edu>; Sun, 13 May 2001 16:27:54 -0700 (PDT)
Received: from mail.sangmyung.ac.kr ([203.237.168.8])
	by fort-point-station.mit.edu (8.9.2/8.9.2) with SMTP id TAA08495
	for <cat-ietf@mit.edu>; Sun, 13 May 2001 19:27:52 -0400 (EDT)
From: tls45@e-guys.com
Received: (qmail 15842 invoked by uid 1005); 13 May 2001 21:54:45 -0000
Received: from ip29.kansas-city12.mo.pub-ip.psi.net (HELO ip29.kansas-city12.mo.pub-ip.psi.net??38.27.143.29?) (38.27.143.29)
  by pine.sangmyung.ac.kr with SMTP; 13 May 2001 21:54:45 -0000
Received: from mail-in.pol.net.uk by ip29.kansas-city12.mo.pub-ip.psi.net with ESMTP; Sun, 13 May 2001 17:56:01 -0500
Message-ID: <000056932240$0000163d$0000427c@mail-in.pol.net.uk>
To: <howard@5Business.cc>
Subject: We are looking for foreign investors                         17020
Date: Sun, 13 May 2001 17:55:53 -0500
MIME-Version: 1.0
Content-Type: text/html;
	charset="iso-8859-1"
Content-Transfer-Encoding: quoted-printable
X-Priority: 3
X-MSMail-Priority: Normal
Reply-To: johnboy@5Business.cc
X-Mailer: QUALCOMM Windows Eudora Version 4.3.2
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk
Content-Transfer-Encoding: quoted-printable

<HTML>
<BODY>

<FONT face=3D"MS Sans Serif">
<FONT size=3D2>
<FONT color=3D"#008000"><B> Currency Trading Made Simple!<BR>
</B></FONT>  <BR>
Do You Have The Yen To Be a A Millionaire?<BR>
 <BR>
<FONT color=3D"#008000"><B> 200% return in less than 90 days!<BR>
 <BR>
</B></FONT> Unique Strategy Trading in the International Currency Markets!=
<BR>
 <BR>
Largest MarketPlace in the World!<BR>
 <BR>
Get our Reports, Charts and Strategies on the U.S. Dollar vs<BR>
Japanese yen and euro dollar.<BR>
 <BR>
<FONT color=3D"#0000FF"><B> Example:<BR>
</B></FONT>  <BR>
A $5,000 Investment in the yen vs the dollar, "properly positioned",<BR>
on 08/18 could have returned $15,000 on 09/19/99. <BR>
<BR>
If you live outside the United States, please contact us today for your FR=
EE information<BR>
packet on Currency Trading.<BR>
<BR>
--------------------------------------------------------------------------=
--------------------------------------------------------------------------=
<BR>
<FONT color=3D"#FF0000"><B> We apologize, but this offer does not apply to=
 United States residents!!  <BR>
</B></FONT> <BR>
<FONT color=3D"#0000FF"><B> Stay tuned:  We are currently concentrating  o=
ur expertise on developing a "CurrencyTrading"<BR>
program for United States residents within 90 days.<BR>
</B></FONT> --------------------------------------------------------------=
--------------------------------------------------------------------------=
------------<BR>
<BR>
<a href=3D"http://865.782.562.95-woocpz-crdqbuxdex-nmbyxz.htm@00000000317.=
00000000161.00000000140.0000000076/currency/default.asp?redirect=3Dwww.hom=
estead.com/vvojo/bxznoonnw/ohjk.htm">click here</a> 
<FONT color=3D"#0000FF"><B> to visit our website....now!!<BR>
</B></FONT> <BR>
<BR>
<BR>
<BR>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D<BR>
Removal Instructions:<BR>
To be removed from our "in house" mailing list <BR>
mailto:chevelle454@hostpro.net?subject=3Dremovepromo<BR>
and you will automatically be removed from future mailings. <BR>
<BR>
You have received this email by either requesting more information <BR>
on one of our opportunities or someone may have used your email address. <=
BR>
If you received this email in error, please accept our apologies.<BR>
<BR>
(Any attempts to disrupt the removal email address etc., will not allow us=
 to<BR>
be able to retrieve and process the remove requests.)<BR>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D<BR>
<BR>
<BR>
</FONT></FONT>
</BODY>
</HTML>


-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


From owner-ietf-cat-wg@lists.Stanford.EDU  Mon May 14 10:30:40 2001
Received: from lists.Stanford.EDU ([171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id KAA13446
	for <cat-archive@odin.ietf.org>; Mon, 14 May 2001 10:30:40 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4EDp9P14098
	for ietf-cat-wg-out720680; Mon, 14 May 2001 06:51:09 -0700 (PDT)
Received: from tholian.securitydynamics.com (mail.rsasecurity.com [204.167.112.129])
	by lists.Stanford.EDU (8.11.3/8.11.3) with SMTP id f4EDp8A14093
	for <ietf-cat-wg@lists.Stanford.EDU>; Mon, 14 May 2001 06:51:08 -0700 (PDT)
Received: from sdtihq24.securid.com by tholian.securitydynamics.com
          via smtpd (for lists.Stanford.EDU [171.64.14.236]) with SMTP; 14 May 2001 13:50:43 UT
Received: from exna00.securitydynamics.com (ebola.securid.com [192.168.7.4])
	by sdtihq24.securid.com (Pro-8.9.3/Pro-8.9.3) with ESMTP id JAA19199;
	Mon, 14 May 2001 09:50:14 -0400 (EDT)
Received: by exna00.securitydynamics.com with Internet Mail Service (5.5.2653.19)
	id <JY8NXS25>; Mon, 14 May 2001 09:50:13 -0400
Message-ID: <F504A8CEE925D411AF4A00508B8BE90A93E5B0@exna07.securitydynamics.com>
From: "Linn, John" <jlinn@rsasecurity.com>
To: "'mrex@sap-ag.de'" <mrex@sap-ag.de>
Cc: ietf-krb-wg@anl.gov,
        "CAT-WG List (E-mail)"
	 <ietf-cat-wg@lists.Stanford.EDU>
Subject: RE: Soliciting additional GSS/Kerberos interoperability results
Date: Mon, 14 May 2001 09:50:00 -0400
MIME-Version: 1.0
X-Mailer: Internet Mail Service (5.5.2653.19)
Content-Type: text/plain;
	charset="iso-8859-1"
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk

(Martin's original message was posted to the Kerberos mailing list; I'm
cross-cc'ing this reply to include CAT-WG as well, as it raises a
cross-mechanism GSS issue.)

Recognizing that RFC-2743 doesn't mandate that conformant mechanisms must
support the individual name types it defines, since support for the
host-based service name type is required at least by RFC-2847 (LIPKEY) as
well as being included within Kerberos implementations, and since multiple
standards-track GSS consumer applications require support for this name type
within their underlying mechanisms, it could be quite disruptive to remove
the type's definition from a successor to RFC-2743.  Unless we lack
suitably-demonstrated implementation experience with a set of mechanism
implementations (not necessarily all, or even most) and of applications
making use of this name type, I believe that its definition should remain.
I'd be interested in any comments that others within the GSS community might
have. 

--jl

> -----Original Message-----
> From: Martin Rex [mailto:martin.rex@sap-ag.de]
> Sent: Friday, May 11, 2001 5:06 PM
> To: Linn, John
> Cc: ietf-krb-wg@anl.gov
> Subject: Re: Soliciting additional GSS/Kerberos 
> interoperability results
> 
> 
> Linn, John wrote:
> > 
> > Kerberos WG:
> > 
> > This will be familiar news for those also subscribing to 
> the CAT-WG mailing
> > list, but I'd like to point out to others in the Kerberos 
> community that
> > we're looking for interoperability testing results which 
> could support
> > advancement of the GSS-API RFCs (2743, and 2744 and/or 
> 2853) to Draft
> > Standards.  We've some results already reported, but could use more.
> > Recognizing that several Kerberos-based GSS implementations 
> exist, I'd like
> > to solicit any summaries which their keepers can provide 
> concerning the
> > scope of testing undertaken, other implementations that 
> have been tested
> > against, and particularly the sets of GSS-selectable 
> features which were
> > exercised in testing.  Please send any results you can 
> offer either to the
> > CAT-WG list at ietf-cat-wg@lists.stanford.edu, or to me as 
> CAT-WG chair.
> > Thanks for any support you can provide in this effort. 
> 
> As it is, I really would like to see section 4.1 removed from
> rfc2743 when it is advance to draft standard because
> 
> (1) the non-support of this nametype by the majority of 
> gssapi mechanisms
> 
> (2) the flawed assumption by application protocol designers that the
>     use of *this* nametype would increase portabilty when in fact it
>     seriously limits portability to a single mechanism (Kerberos).
> 
> (3) the suggestion to "canonicalize" the hostname part via DNS,
> 
> 
> -Martin
> 
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


From owner-ietf-cat-wg@lists.Stanford.EDU  Mon May 14 13:22:47 2001
Received: from lists.Stanford.EDU ([171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id NAA18786
	for <cat-archive@odin.ietf.org>; Mon, 14 May 2001 13:22:46 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4EGicv21563
	for ietf-cat-wg-out720680; Mon, 14 May 2001 09:44:39 -0700 (PDT)
Received: from smtpde02.sap-ag.de (smtpde02.sap-ag.de [194.39.131.53])
	by lists.Stanford.EDU (8.11.3/8.11.3) with ESMTP id f4EGibA21558
	for <ietf-cat-wg@lists.Stanford.EDU>; Mon, 14 May 2001 09:44:37 -0700 (PDT)
Received: from sap-ag.de (smtpde02)
  by smtpde02.sap-ag.de (out) with ESMTP id SAA07080;
  Mon, 14 May 2001 18:44:45 +0200 (MESZ)
From: Martin Rex <martin.rex@sap-ag.de>
Message-Id: <200105141643.SAA28062@hw1464.wdf.sap-ag.de>
Subject: Re: Soliciting additional GSS/Kerberos interoperability results
To: jlinn@rsasecurity.com (Linn John)
Date: Mon, 14 May 2001 18:43:45 +0200 (METDST)
Cc: mrex@sap-ag.de, ietf-krb-wg@anl.gov, ietf-cat-wg@lists.Stanford.EDU
In-Reply-To: <F504A8CEE925D411AF4A00508B8BE90A93E5B0@exna07.securitydynamics.com> from "Linn, John" at May 14, 1 09:50:00 am
Reply-To: mrex@sap-ag.de
MIME-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 8bit
X-SAP: out
X-SAP: out
X-SAP: out
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk
Content-Transfer-Encoding: 8bit

Linn, John wrote:
> 
> Recognizing that RFC-2743 doesn't mandate that conformant mechanisms must
> support the individual name types it defines, since support for the
> host-based service name type is required at least by RFC-2847 (LIPKEY) as
> well as being included within Kerberos implementations, and since multiple
> standards-track GSS consumer applications require support for this name type
> within their underlying mechanisms, it could be quite disruptive to remove
> the type's definition from a successor to RFC-2743.

Why should it be disruptive.  The hostbased service name is still
present in rfc1964, the Kerberos gssapi mechanism, where it originates
and where it belongs.

rfc-2847 (lipkey) is an incomplete spec, just as rfc-2025 (spkm) is
an incomplete spec.  I've been complaining about spkm long ago and
I have raised that problem during WG last call of lipkey, but nobody
wanted to see the document delayed.  spkm and lipkey _both_lack_
a mechanism specific nametype and lipkey, although it requires
support for the hostbased service name, can not provide a definition
of how to map from the hostbased service name namespace into the
mechanism specific namespace, simply because such a namespace
was never defined.  How do you expect independent implementors
to come up with independent interoperable implementations if the
spec doesn't even contain the slightest hint about what to do?
I've seen several independent implementations of SPKM1 and not
two of them are interoperable on names.  GREAT work, really!


>                                                         Unless we lack
> suitably-demonstrated implementation experience with a set of mechanism
> implementations (not necessarily all, or even most) and of applications
> making use of this name type, I believe that its definition should remain.
> I'd be interested in any comments that others within the GSS community might
> have. 

It would be perfectly sufficient to have the hostbased service name in the
gssapi mechanism spec only. 

Maybe not as drastic as removing them, we should at least indicate all
the nametypes in rfc-2743 as being purely optional and that a portable
application must be prepared that a gssapi mechanism may not be able
to map any of them into their mechanism native (or mechanism specific)
namespace.

The notion of hostbased service names is very Kerberos-specific.
Other GSS-API mechanisms or when used with non-TCP/IP transports
or when used across firewalls/proxies the notion of hostbased
service names does not scale to today's application environments.

The suggestion to transform the hostname part through DNS should
be removed, or at least be rewritten as

when used for mutual authentication, the hostname part of a hostbased
service name SHOULD NOT be transformed through an insecure naming
service like conventional DNS before being used for verifying
the authenticated peer.

-Martin

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


From owner-ietf-cat-wg@lists.Stanford.EDU  Fri May 25 07:07:39 2001
Received: from lists.Stanford.EDU (lists.Stanford.EDU [171.64.14.236])
	by ietf.org (8.9.1a/8.9.1a) with SMTP id HAA14818
	for <cat-archive@odin.ietf.org>; Fri, 25 May 2001 07:07:38 -0400 (EDT)
Received: (from root@localhost)
	by lists.Stanford.EDU (8.11.3/8.11.3) id f4PAD4V17076
	for ietf-cat-wg-out720680; Fri, 25 May 2001 03:13:04 -0700 (PDT)
Received: from mx0.gmx.net (mx0.gmx.net [213.165.64.100])
	by lists.Stanford.EDU (8.11.3/8.11.3) with SMTP id f4PAD3V17063
	for <ietf-cat-wg@lists.stanford.edu>; Fri, 25 May 2001 03:13:03 -0700 (PDT)
Received: (qmail 24430 invoked by alias); 25 May 2001 10:12:47 -0000
Delivered-To: GMX delivery to claudia%carmendorn@gmx.de
Received: (qmail 24423 invoked by uid 0); 25 May 2001 10:12:47 -0000
Date: Fri, 25 May 2001 12:12:46 +0200 (MEST)
From: Carmen Dornbach <CarmenDorn@gmx.de>
MIME-Version: 1.0
X-Priority: 3 (Normal)
X-Authenticated-Sender: #0010896236@gmx.net
X-Authenticated-IP: [195.93.64.171]
Message-ID: <27440.990785566@www31.gmx.net>
X-Mailer: WWW-Mail 1.5 (Global Message Exchange)
Content-Type: text/plain; charset="iso-8859-1"
To: claudia%CarmenDorn@gmx.de
Sender: owner-ietf-cat-wg@lists.Stanford.EDU
Precedence: bulk
X-MIME-Autoconverted: from 8bit to quoted-printable by lists.Stanford.EDU id f4PAD4V17076
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by ietf.org id HAA14818

Hallo,

wir sind 9 heiße und hemmungslose Girls, nämlich Babette, Moni, Carola,
Angelique, Michelle, Jessica, Melissa, Iris und Sandra, die ein geiles tabuloses
Telefonat, oder bei gefallen einen heißen Seitensprung suchen. Ganz wie Du
willst :o)

Erreichen kannst Du uns direkt unter Telefonnummer: 019085/4794*

Am Telefon können wir uns gleich ein Date ausmachen. Oder hast Du etwa keine
Lust auf einen wilden One Night Stand ? Wir schon :o) ... also beeil Dich
.... fg

Wenn Du uns vorher sehen möchtest, dann schau einfach mal auf unserer
Homepage vorbei ... dort erfährst Du einiges mehr über uns ... www.datingfon.de 

Unsere intimsten Geheimnisse verraten wir Dir natürlich nur direkt ... wir
können sie Dir ja am Telefon ins Ohr flüstern ... 

Also alles ist möglich weil wir auf alles Lust haben und noch so vieles
ausprobieren wollen .... hoffentlich mit Dir. ... 019085/4794*

Lass uns nicht so lange warten ....

Bussi bis gleich Deine süssen Girls








(* E.p. DM 3,63/min.)

-- 
GMX - Die Kommunikationsplattform im Internet.
http://www.gmx.net

--
U2 Konzertreisen inkl. VIP-Package
Hier Eventreisen zur U2-Tour bei Getgo.de online buchen!
http://www.getgo.de/cgi-bin/TDoc.dll?doc=reisen/rei_kon_sta&affiliate=GMX

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to majordomo@lists.stanford.edu


