Subject: RE: Kerberos-revisions nits and comments

From: "John Brezak" <[email-masked]>
Date: Tue, 30 Oct 2001 16:22:54 -0800

Any comments?

	-----Original Message-----
	From: John Brezak 
	Sent: Thursday, October 25, 2001 4:35 PM
	To: [email-masked]
	Subject: Kerberos-revisions nits and comments

	1) I notice that the rfc-1510 pseudo-code has replay detection
in the TGS-REQ verification section. In 1510bis, there is some
discussion about replay detection in the TGS saying that you can't
really do this reliably in UDP, but the pseudo-code still has it. It
would be great to be clear if replay detection is really needed in the
TGS and specify what is to be done for both the UDP and TCP cases.
	 
	2) How is PA-USE-SPECIFIED-KVNO to be used? Is this to be used
in conjunction with a krb-error(KRB-AP-ERR-BADKEYVER) from a failed
AP-REQ to a server? If so how does the server communicate the specified
kvno to the client so that it can discard the current ticket and request
a new one for the server with the PA-USE-SPECIFIED-KVNO?

	=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

	John Brezak                       * mailto:[email-masked]

	Microsoft Corporation        ( 425-706-2602

	One Microsoft Way

	Redmond, WA 98052