Subject: GSSish TLS?

From: "Mike Spreitzer" <[email-masked]>
Date: Tue, 1 Feb 2000 16:58:47 PST

I find the stream-filtering nature of TLS useful beyond the confines of the security enhancements TLS is currently defined to
provide.  I could ask for more out of TLS, but why duplicate work?  We already have an IETF standard framework for security
enhancements, namely the GSS-API.  It seems natural to want to create a TLS-like stream filter that transports the tokens that the
GSS is defined to produce/consume.  This could even be done in a way that keeps parts of the existing TLS --- just define two new
message types to carry the tokens from the two phases (setup, then data) of GSS exchange.

I know there was some discussion of something like this early in the history of the TLS WG.  Perhaps the situation is different now;
perhaps I'm not asking for exacly the same thing.  I'm not implying which, if any, existing WG this would fall to.  But I am asking
for the benefit of your wisdom.

Does this make sense?  If so, where should the effort be homed?

Thanks,
Mike

-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 01 Feb 2000 22:09:05 -0600

This was discussed at the last IETF in both the TLS and CAT working groups. 
Frank Siebenlist discussed a GSSAPI using SSL/TLS at the CAT group.
Mark Davis discussed delegation with TLS at the TLS meeting.

As pointed out in the above two sessions, the Globus project,
http://www.globus.org/security has implemented a GSSAPI using SSL and the 
SSLeay package. GSI supports GSS delegation using "proxy" certificates
as well as user-to-user authentication. Works with smartcards via PKCS#11. 
Runs on WIN32, and most UNIX platforms. Can use the MIT gssftp. We have mods to 
ssh to use GSSAPI as an authentication method, which are included in SecureCRT. 

If you are interested, see me at the ISOC NDSS this week. 

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]

---

From: Frank Siebenlist <[email-masked]>
Date: Wed, 02 Feb 2000 11:41:35 -0800

Mike,

At the last IETF meeting, Paul Leach from Microsoft told the meeting that the latest Windows 2000 already has a gssapi equivalent for a ssl/tls mechanism.

Paul also claimed that documentation would be available that describes the implementation. So far, we haven't been able to find any, though. I've send Paul an email to request for more info but never got any response.

Maybe Paul is willing to share with the list where we could find detailed information about MS' gss-ssl mechanism?

Regards, Frank.

-- 
Frank Siebenlist              Tivoli SecureWay
Security Geek Supreme         3004 Mission Street
Email: [email-masked]          Santa Cruz, CA 95060, USA
Phone: +1 408/871-8072        +1 831/460-3600 (switch)        
Fax:   +1 831/460-0255
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]