On 10/3/12 9:26 AM, "Jim Basney" <[log in to unmask]> wrote:
>Thanks Sam and Scott for the consideration/discussion of this patch.
>Here's an updated patch that adds a GSSAPIRequireMIC sshd_config option
>to enable the "site policy decision for the server whether or not to
>permit authentication using GSS-API mechanisms and/or contexts that do
>not support per-message integrity protection." The default is "yes" to
>require integrity protection, and our mech_saml_ec implementation
>currently requires this option to be set to "no".
In parallel, I reconsidered how to support keying sessions in the typical
case and realized that in fact it is best if the IdP just supplies a key
to both parties, so I'm reworking the SAMLEC drafts now to include that.
But I still think that if the RFC says you don't have to have a MIC that
such an option is entirely appropriate and necessary.
-- Scott
|