On Mon, Nov 03, 2008 at 11:10:20AM +1300, Brian E Carpenter wrote: > Comments: > > Here, then, is a generic re-statement of this structure, in pseudo- > ASN.1: > > What's pseudo-ASN.1? This is normative, so why isn't it ASN.1?
RFC2743 lays out the *abstract* API for "generic security services". RFC2743 uses "pseudo-ASN.1". I kept the style of RFC2743. > I can't parse this sentence: > > Where a language binding of the GSS-API models channel bindings as > OCTET STRINGs (or the language's equivalent), then the implementation > MUST assume that the given bindings correspond only to the > application-data field of GSS-CHANNEL-BINDINGS as shown above, rather > than some encoding of GSS-CHANNEL-BINDINGS. > > 1. Is the 'as' supposed to mean 'only as'? More like "as a single OCTET STRING". > 2. Why is this restricted to the application-data field? Why doesn't > it also cover the various address fields? (OK, there's a clue hidden > in the Security Considerations, but the explanation belongs here.) Because RFC2743 said "OCTET STRING" and later RFC2744 imposed structure without specifying an encoding of that structure to an OCTET STRING. That's an old screwup. Now, if anyone had built a language binding based strictly on RFC2743 then they'd have only an OCTET STRING input. What to do? Well, since those "network addresses" in the RFC2744 channel binding structure turned out to be utterly useless[*] and since such a language binding would not have intended for network-addresses-as-channel-bindings, the simplest choice is as given above. > 3. Maybe I'm lacking context, but the 'rather than' clause doesn't make > sense to me at all. I think it can be removed. Also, I suppose the MUST should be a SHOULD. > Now, if what this is actually saying is that "Where a language binding > does not support a SEQUENCE (or the language's equivalent)..." > I could make some sense of it. But then the (pseudo) ASN.1 would need > to be different, since the address fields would be absent. The pseudo-ASN.1 sequence applies to language bindings that conform to this document. Pre-RFC2744 language bindings would likely have a single octet string input argument for channel bindings, and the above sentence states that for those "legacy" bindings this octet string input argument corresponds to the application-data field of the pseudo-ASN.1 sequence. Nico -- _______________________________________________ Gen-art mailing list [email protected] https://www.ietf.org/mailman/listinfo/gen-art
