Clarifications and Extensions to the Generic Security Service Application Program Interface (GSS-API) for the Use of Channel Bindings
updates
- rfc-2743 — Generic Security Service Application Program Interface Version 2, Update 1
Extracted elements (9)
The channel bindings structure in the C-bindings specification (RFC 2744) is actually generic in nature despite being expressed in C syntax; this document generalizes it using pseudo-ASN.1 to make it accessible to all language bindings, fixing an incomplete treatment in the base RFC 2743 specification.
The GSS-CHANNEL-BINDINGS structure is presented in pseudo-ASN.1 but no standard encoding is mandated because this structure is part of an abstract API, not a protocol defining bits on the wire; each GSS-API mechanism encodes the contents in a mechanism-specific way.
RFC 4121 (Kerberos V GSS-API mechanism) defines an encoding of the GSS-CHANNEL-BINDINGS structure that hashes the encoded form; other GSS-API mechanisms are free to reuse that encoding.
All new GSS-API mechanisms that support channel binding MUST conform to RFC 5056 (On the Use of Channel Bindings to Secure Channels).
New language-specific bindings of the GSS-API SHOULD specify a language-specific formulation of the abstract GSS-CHANNEL-BINDINGS structure.
Where a language binding of the GSS-API models channel bindings as OCTET STRINGs (or the language's equivalent), the implementation MUST assume that the given bindings correspond only to the application-data field of GSS-CHANNEL-BINDINGS, rather than some encoding of the full GSS-CHANNEL-BINDINGS structure.
The abstract GSS-CHANNEL-BINDINGS structure is defined as a SEQUENCE containing: initiator-address-type (INTEGER), initiator-address (OCTET STRING), acceptor-address-type (INTEGER), acceptor-address (OCTET STRING), and application-data (OCTET STRING). Address field semantics follow RFC 2744; application-data follows RFC 5056.
End-point channel bindings must not be modeled as network addresses; if they were, such channel bindings might not be usable with all language bindings of the GSS-API, limiting interoperability and security guarantees.
Language bindings that use OCTET STRING for channel bindings will not support network addresses as channel bindings, but this does not cause security problems because using network addresses as channel bindings is not generally secure.