Mailing-List: contact users-help@qpid.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@qpid.apache.org
Received-SPF: pass (athena.apache.org: domain of astitcher@redhat.com
 designates 209.132.183.28 as permitted sender)
Message-ID: <1424888909.3332.17.camel@fuschia>
Subject: Re: Proposed SASL changes (API and functional)
From: Andrew Stitcher <astitcher@redhat.com>
To: proton@qpid.apache.org
Cc: users@qpid.apache.org
Date: Wed, 25 Feb 2015 13:28:29 -0500
In-Reply-To: <1424879165.2611.53.camel@wallace.redhat.com>
References: <1424810902.3410.15.camel@redhat.com>
	 <1424879165.2611.53.camel@wallace.redhat.com>
Content-Type: text/plain; charset="UTF-8"
Mime-Version: 1.0
Content-Transfer-Encoding: 7bit

On Wed, 2015-02-25 at 10:46 -0500, Alan Conway wrote:
> ...
> One ignorant question: Qpid has a min/max "Security Strength Factor" for
> encryption rather than a binary enable/disable. Is that relevant here?

(Hardly an ignorant question!) You make a very good point, and this
design may indeed be a little simplistic - largely because I've not
implemented the encryption side yet!

1. I doubt that max ssf is all that useful in practice.
2. Effectively pn_transport_require_encryption() is the same as setting
min ssf >1, but is simpler to understand! An alternative might be
pn_transport_require_ssf(int) however that isn't as clear and it's not
obvious how to choose the ssf value. Perhaps the '1' should be
configurable differently.

Some input from those who did the similar work in qpidd might be useful.

Just some random wittering.

Andrew


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@qpid.apache.org
For additional commands, e-mail: users-help@qpid.apache.org