Subject: Open issues with extensibility proposal

From: Sam Hartman <[email-masked]>
Date: Fri, 7 Dec 2001 16:01:34 -0500 (EST)

So our proposal on Kerberos extensibility has generated a fair bit of
traffic; enough that if we aren't careful details may get dropped in
the messages flying back and forth.  Since a lot of important points
have been raised I'd like to make sure that doesn't happen.  Here is
my list of open issues and fixes brought up on the list so far.  If
you brought up some point that is either still open or requires a
change be made, please make sure it is here.

			     Open Issues

* Jeff Altman should be posting a summary of questions related to how
  this all fits into UTF8.  That should lead to a response to John's
  comment about  KerberosString definition.

* We need to decide if we expand  the Signed types.

* We need to come up with a concrete proposal on multiple
  implementations with a single ccache, especially looking at
  forwarding.

* We need to look at how this works for U2U.  I plan to sit down with
  Tom and Ken, walk through a U2U session  and double check what
  happens there; then  we should have a reasonable solution to
  propose.

* We need to look at tr-encoding.

* I need to send out KRB-ERROR guidelines.

* I think there may be a few missing extension markers in the ASN.1
  module; I will talk to Tom about this.

				Fixes
Here are fixes proposed on the list there seem to be no objections to:

* Require TCP 

* Add nonce to KRB-ERROR

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 07 Dec 2001 16:08:56 -0500

>Here are fixes proposed on the list there seem to be no objections to:

Wait, hold on one second ... require TCP for _what_?  All KDC/Client
communication?  Just "big" packets?  I think I object to a blanket statement.

--Ken

---

From: Ken Hornstein <[email-masked]>
Date: Fri, 07 Dec 2001 16:44:23 -0500

>    Ken> Wait, hold on one second ... require TCP for _what_?  All
>    Ken> KDC/Client communication?  Just "big" packets?  I think I
>    Ken> object to a blanket statement.
>
>Require KDCs to implement TCP.

Ah, okay.  No objection.

--Ken

---

From: Sam Hartman <[email-masked]>
Date: 07 Dec 2001 16:36:29 -0500

>>>>> "Ken" == Ken Hornstein <[email-masked]> writes:

---

From: Nicolas Williams <[email-masked]>
Date: Fri, 7 Dec 2001 16:57:09 -0500

Require TCP support in the KDC. And require UDP support as well.

Let the site admins decide which the clients will use, and/or let
clients decided based on packet size heuristics.

No?

Nico

--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Sun, 9 Dec 2001 20:28:20 -0700 (MST)

> * Require TCP 

Already in kerberos-revisions-10.