Subject: Issue 24 MUST/SHOULD in clock skew (section 7.1)

From: Kazunori Miyazawa <[email-masked]>
Date: Fri, 04 Feb 2005 13:35:17 +0900

Hello,

#24 [*] MUST/SHOULD in clock skew (section 7.1)

	The time difference MUST be computed and SHOULD be stored
	and used?  Why the different requirement levels?  (And is this sort of
	thing in the domain of KINK or Kerberos?)  (Ken Raeburn)

I considered this issue.

The clarifications does not mention clock skew processing in the client/server
authentication exchange. The way to process the skew is left to an application.

I think the clock skew processing is an implementation and/or operational issue
in KINK. However the server must provide the ctime because the client may want
to continue the process though there is skew.

I propose that KINK filling out ctime is MUST but KINK should not decide the
processing.

--
Kazunori Miyazawa

---

From: "KAMADA Ken'ichi" <[email-masked]>
Date: Tue, 22 Feb 2005 09:19:50 +0900

At Fri, 04 Feb 2005 13:35:17 +0900,
> I propose that KINK filling out ctime is MUST but KINK should not decide the

I agree that the server MUST fill out ctime (and the current draft
also says so).

Regarding clients, do you mean KINK should not describe the
processing, or should not use capital letters?
I like SHOULD, or have no problem with describing small letters if the
WG prefers it.  But I think "not describing the processing" is not
appropriate because it is not specified by Kerberos (as far as I know)
and clients don't know how to process ctime without it.

-- 
KAMADA Ken'ichi <[email-masked]>