Subject: RE: GSSish TLS?

From: Paul Leach <[email-masked]>
Date: Wed, 2 Feb 2000 12:45:40 -0800

SSPI doc is at
http://msdn.microsoft.com/isapi/msdnlib.idc?theURL=/library/psdk/secspi/port
alsspi_1545.htm
Under the subtopic "Using SSPI" is specific info about SSL and SSPI.

> -----Original Message-----
> From: Frank Siebenlist [mailto:[email-masked]]
> Sent: Wednesday, February 02, 2000 11:42 AM
> To: Mike Spreitzer
> Cc: [email-masked]; [email-masked]; Jeffrey I.
> Schiller; Marcus Leech; Allison Mankin; Paul Leach
> Subject: Re: GSSish TLS?
> 
> 
> Mike,
> 
> At the last IETF meeting, Paul Leach from Microsoft told the 
> meeting that the latest Windows 2000 already has a gssapi 
> equivalent for a ssl/tls mechanism.
> 
> Paul also claimed that documentation would be available that 
> describes the implementation. So far, we haven't been able to 
> find any, though. I've send Paul an email to request for more 
> info but never got any response.
> 
> Maybe Paul is willing to share with the list where we could 
> find detailed information about MS' gss-ssl mechanism?
> 
> Regards, Frank.
> 
> 
> Mike Spreitzer wrote:
> > 
> > I find the stream-filtering nature of TLS useful beyond the 
> confines of the security enhancements TLS is currently defined to
> > provide.  I could ask for more out of TLS, but why 
> duplicate work?  We already have an IETF standard framework 
> for security
> > enhancements, namely the GSS-API.  It seems natural to want 
> to create a TLS-like stream filter that transports the tokens that the
> > GSS is defined to produce/consume.  This could even be done 
> in a way that keeps parts of the existing TLS --- just define two new
> > message types to carry the tokens from the two phases 
> (setup, then data) of GSS exchange.
> > 
> > I know there was some discussion of something like this 
> early in the history of the TLS WG.  Perhaps the situation is 
> different now;
> > perhaps I'm not asking for exacly the same thing.  I'm not 
> implying which, if any, existing WG this would fall to.  But 
> I am asking
> > for the benefit of your wisdom.
> > 
> > Does this make sense?  If so, where should the effort be homed?
> > 
> > Thanks,
> > Mike
> > 
> > -++**==--++**==--++**==--++**==--++**==--++**==--++**==
> > This message was posted through the Stanford campus mailing list
> > server.  If you wish to unsubscribe from this mailing list, send the
> > message body of "unsubscribe ietf-cat-wg" to 
> [email-masked]
> 
> -- 
> Frank Siebenlist              Tivoli SecureWay
> Security Geek Supreme         3004 Mission Street
> Email: [email-masked]          Santa Cruz, CA 95060, USA
> Phone: +1 408/871-8072        +1 831/460-3600 (switch)        
> Fax:   +1 831/460-0255
> -++**==--++**==--++**==--++**==--++**==--++**==--++**==
> This message was posted through the Stanford campus mailing list
> server.  If you wish to unsubscribe from this mailing list, send the
> message body of "unsubscribe ietf-cat-wg" to 
> [email-masked]
> 
-++**==--++**==--++**==--++**==--++**==--++**==--++**==
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]