Subject: PRF_READY -- a proposal

From: Nicolas Williams <[email-masked]>
Date: Mon, 18 Apr 2005 15:28:16 -0500

So, Sam has given us good reasons to add a PROT_READY-like equivalent
for PRF_READY that would work for the krb5 mechanism.

Martin indicated support for an additional input parameter to GSS_PRF()
to support this feature, as did I.

I'm now ready to make a specific proposal:

 - add an input parameter, 'prf_key', of type INTEGER, to GSS_PRF()

    - in the C, Java and C# bindings the type would be 'int'

 - add three constant values for this INTEGER field:

    - GSS_C_PRF_KEY_DEFAULT
    - GSS_C_PRF_KEY_PARTIAL
    - GSS_C_PRF_KEY_OTHER

 - these three constants will correspond, in order, to the fully
   established krb5 sec context key (acceptor, initiator, ticket session
   keys, in that order), the partially established krb5 sec context key
   (initiator, ticket session keys, in that order), and the ticket
   session key

Rationale for INTEGER as the parameter's type, as opposed to BOOLEAN or
BIT STRING (i.e., flags): BOOLEAN has too few values considering the
fact that in the Kerberos V mechanism there might be up to three keys
one might want to use for the PRF, but I can imagine no mechanism in
which more than one key could be used for any one call to GSS_PRF(), so
a BIT STRING seems inappropriate, which leaves me with INTEGER or
some enumerated type, and since RFC2743 does not use any enumerated
type, I chose INTEGER.

Comments?

I'll post text soon.  Remember, we're in WGLC.

Nico
-- 

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten