Subject: Re: krbrev - Kerberos revisions section 6

From: Clifford Neuman <[email-masked]>
Date: Wed, 18 Jul 2001 11:16:56 -0700 (PDT)

All,

A revised section 6, by Ken Raeburn is on the site.  Please provide
feedback to Ken <[email-masked]>, CC'ed to me, but not the list, that
is as specific as possible, suggesting specific changes, or if you
don't know the specific change, pointing out your concern.  There are
some comments interspersed with the text of this section as well as
the general commentary at the end.

I've asked Ken to send me updates as he changes this section, and to
respond directly to the inquiries, CCing the list with the original
suggestion and the change made if a change is made, or back to the
person making the comment if clarification is required.

The revisions can be found at:

   http://www.isi.edu/people/bcn/krb-revisions

Clifford Neuman

---

From: Ken Raeburn <[email-masked]>
Date: 24 Jul 2001 12:05:27 -0400

First, some comments of my own...

I think the specification of the individual key usage numbers is
presented poorly.  Having a table summarizing the values, either in
section 6 or section 8, is all well and good, but numbers should also
be specified at every place in the rest of the document where we say
"encrypt foo".  Instead, it should say "encrypt foo with key usage
value 8 when using the TGS session key, or key usage value 9 when
using the subkey".  This makes all the information clear to the
implementor in one place when he's working on handling a given message
type, and should also make it more obvious if we accidentally left out
any cases.  That requires changes through section 5, which Tom is
still working on, some in Appendix B, and perhaps elsewhere.

I'm still waiting for feedback from Uri Blumenthal on the combine-keys
function I threw together.

I'm thinking the "The format cannot be described in ASN.1, but for
those who prefer an ASN.1-like notation" parts should perhaps be
thrown out; they don't add anything IMHO.  Are they actually useful to
anyone, given that we've got the ASCII-art diagrams as well?

Ken