[Spice-devel] [PATCH] protocol: RFC: add common channel caps for AUTH mechanism selection

[Marc-André Lureau]

hi

----- Original Message -----
> Hi,
> 
> On 02/13/2011 03:34 PM, Yaniv Kaul wrote:
> > On 2/13/2011 4:23 PM, Marc-André Lureau wrote:
> >> Current version 2.0 of the SPICE protocol describes how the client
> >> reply to the server SpiceLinkReply message with a
> >> RSA_public_encrypt()
> >> of the password.
> >>
> >> Instead of using the current Spice AUTH mechanism, we would like to
> >> offer different AUTH mechanisms, in particular SASL, which is a
> >> framework allowing different underlying mechanisms such as
> >> GSSAPI/Kerberos v5 (and optionally adding a data security layer).
> >
> > How can we re-use the authentication result of the first channel
> > with the other channels?
> > It never made sense to me to perform the authentication per-channel.
> 
> Well given that each channel is a separate tcp connection, and any one
> of
> the connections could be hijacked, it does make sense IMHO. We would
> of
> course only do the AUTH mechanism negotation for the main channel and
> then reuse the result for the others.
> 


The AUTH mechanism selection is fairly cheap: 2 x 1 bit + u32 (we could use a u8 instead). There is no extra round trip.

Enforcing the same AUTH mechanism on each channel would make us lose some flexibility, we could imagine that a channel is public, for instance display and audio, for read-only / multi-client cases.

regards

-- 
Marc-André Lureau