The requirement that initiating receiving entity drop all knowledge it learned before negotiating SASL layers (rule 5) is too broad. This could be viewed as requiring the implement to forget knowledge it gained previously in a secure manner (such as an externally established lower level (IPSEC or TLS) identity information). Likewise for rule 6.
Rules 5 and 6 are specific to the use of SASL mechanisms which are actively providing encryption/integrity protection. In this situation, it is known that TLS is not in use. I doubt it is known whether or not IPSec is in use for the entire communication path. Therefore, all information obtained prior to the establishment of encryption/integrity protection must be considered suspect.
I believe the problem is one of language. Can we replace all references to "security layer" to read "data protection layer"?
Alexey __________________________________________ Isode Limited, http://www.isode.com
IETF standard related pages: http://orthanc.ab.ca/mel/devel/Links.html
Personal Home Page: http://orthanc.ab.ca/mel __________________________________________