Subject: draft-ietf-cat-iakerb-08.txt

From: Jonathan Trostle <[email-masked]>
Date: Mon, 17 Sep 2001 13:13:53 -0700

Doug,

I have made the requested changes (from WG last call) to iakerb07 and
iakerb08 is now in the repository. Here are the list of changes:

(1) An IAKERB server which also used the krb-dns-locate facility
     could allow an attacker to change DNS, and use the IAKERB server
     to attack other machines.

I have added a description of this issue and several possible
countermeasures on pp.11-12 in the security considerations section of the
draft. 

(2) The draft should say it will use DER.

I added that the KRB_TKT_PUSH message is encoded using ASN.1 DER
in the bottom of p. 8.

(3) The draft may lead one to imply the SPNEGO was required since it
     defined multiple mechanisms, and this could lead to other problems
     as well. 

P. 4 Section 5, addresses this issue.

Additional clarifying text was added in a few places: P. 9 a new figure is
added to illustrate the minimal messages AS case, pp. 10-11 new step by
step text for both client and server for the minimal messages TGS protocol. 

The draft is now ready to be forwarded to the IESG per your decision at the
end of WG last call.

Jonathan