Subject: Re: enctype negotiation and GSS naming extensions

From: Sam Hartman <[email-masked]>
Date: Tue, 05 Apr 2005 09:13:33 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> At MN I said I did not oppose Larry's Kerberos enctype
    Nicolas> negotiation proposal.

    Nicolas> I'm less sure now.

    Nicolas> You may recall that at the interim meeting at Boulder we
    Nicolas> decided that extensions would add a typed hole, distinct
    Nicolas> from authorization-data, to the authenticator and AP-REP.
    Nicolas> We'd argued over whether it was proper to overload
    Nicolas> authorization-data and decided that it was not.

    Nicolas> Larry's proposal overloads authorization-data by using it
    Nicolas> to transport a client's enctype proposal to the server.

    Nicolas> I am still inclined to agree that enctype negotiation is
    Nicolas> an allowable overloading of authorization-data, but the
    Nicolas> GSS-API naming extensions we're discussing at the KITTEN
    Nicolas> WG give me pause.

I've thought about this for a while and I also think it is reasonable
overloading if only because we don't want to tell Larry to wait for
extensions.

--Sam

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 5 Apr 2005 11:44:08 -0500

> overloading if only because we don't want to tell Larry to wait for

Ok, and as a one-time thing a mechanism implementation could filter
enctype negotiation AD out in the GSS naming interfaces.

I have no remaining objections to Larry's proposal.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 05 Apr 2005 13:06:40 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Tue, Apr 05, 2005 at 09:13:33AM -0400, Sam Hartman
    Nicolas> wrote: I am still inclined to agree that enctype
    Nicolas> negotiation is an allowable overloading of
    Nicolas> authorization-data, but the GSS-API naming extensions
    Nicolas> we're discussing at the KITTEN WG give me pause.
    >>  I've thought about this for a while and I also think it is
    >> reasonable overloading if only because we don't want to tell
    >> Larry to wait for extensions.

    Nicolas> Ok, and as a one-time thing a mechanism implementation
    Nicolas> could filter enctype negotiation AD out in the GSS naming
    Nicolas> interfaces.

Could but should not.