Subject: Re: [kitten] WGLC on draft-ietf-krb-wg-cammac-08

From: Tom Yu <[email-masked]>
Date: Fri, 01 Aug 2014 15:13:27 -0400

"Zheng, Kai" <[email-masked]> writes:

> Regarding the following:
> ===
> However, protocol extensions such as Constrained Delegation (S4U2Proxy
>    [MS-SFU]) require that a service present to the KDC a service ticket
>    that the service received from a client, as evidence that the client
>    authenticated to the service.  In the S4U2Proxy extension, the KDC
>    uses the evidence ticket as the basis for issuing a derivative ticket
>    that the service can then use to impersonate the client.
> ===

[...]

> This forwardable service ticket might have been obtained by a
> KRB_AP_REQ and come from the user client (the case mentioned here), or
> by an S4U2self request (ignored here).

Hi Kai,

Thanks for your comment.  I can see how apparently ignoring tickets
obtained from S4U2Self could be distracting or confusing to a reader.
Would the following text be better?

   However, protocol extensions such as Constrained Delegation
   (S4U2Proxy [MS-SFU]) require that a service present to the KDC a
   service ticket that the KDC previously issued, as evidence that the
   service is authorized to impersonate the client principal named in
   that ticket.  In the S4U2Proxy extension, the KDC uses the evidence
   ticket as the basis for issuing a derivative ticket that the service
   can then use to impersonate the client.

---

From: "Zheng, Kai" <[email-masked]>
Date: Mon, 4 Aug 2014 13:57:20 +0000

Hi Tom,

Yes it looks better. Thanks for your response!

Regards,
Kai

-----Original Message-----
From: Tom Yu [mailto:[email-masked]] 
Sent: Saturday, August 02, 2014 3:13 AM
To: Zheng, Kai
Cc: Shawn M Emery; [email-masked]
Subject: Re: [kitten] WGLC on draft-ietf-krb-wg-cammac-08

[...]

Hi Kai,

Thanks for your comment.  I can see how apparently ignoring tickets obtained from S4U2Self could be distracting or confusing to a reader.
Would the following text be better?