assoc_type and assoc_handle

[Paul Crowley]

Paul Crowley wrote:
> Brad Fitzpatrick wrote:
> 
>> So we need to either add assoc_type to checkid_* mode (easier?) or merge
>> assoc_type into the assoc_handle, as was proposed with the x.500/ldap/etc
>> format of "{HMAC-TIGER}gibberishfooo"

Fickle person that I am, I've changed my mind back again.  Not forcing 
people to know in advance what assoc_type an assoc_handle is associated 
with is just inviting them to write code that's vulnerable to an 
assoc_type substitution attack.  Servers can trivially encode it in the 
handle in any way they like if they need to; consumers must just 
remember.  I've removed all mention of assoc_type from the 
identification protocol; it's now only part of the association protocol.
-- 
   __
\/ o\ Paul Crowley, paul at ciphergoth.org
/\__/ http://www.ciphergoth.org/