Subject: [Isms] sshtm: security name translation

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 4 Jul 2007 18:01:22 +0200

Hi,

security name translation comments based on
draft-ietf-isms-secshell-07.txt:

The document specifies in several places that the authenticated
identity might be translated into a securityName by something
different then the identity transform (p12, p16, MIB module). I
believe this is a feature not needed (at least I do not see the use
case) and potentially a security nightmare (since VACM gets to see an
identity, the securityName) which was not actually authenticated. I
propose that this translation capability be dropped - this also
implies to remove the whole sshtmUserTable and the supporting spin
lock.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1, 28759 Bremen, Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

_______________________________________________
Isms mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/isms