Subject: Re: [extensibility 3] details of negotiation and guidelines

From: Jeffrey Altman <[email-masked]>
Date: Mon, 17 Dec 2001 13:18:54 EST

> On Mon, Dec 17, 2001 at 10:25:16AM -0500, Jeffrey Altman wrote:
> > Nico wrote:
> > > Yes, but, AS-REQ w/ PA-AS-REQ is to be used for PROBING KDC support for
> > > new Kerberos. If the KDC lacks that support then the outer AS-REQ has to
> > > be somewhat meaningful. At the very least there must be a cname/crealm
> > > and sname/srealm, which brings up the question of what to use for those
> > > when the intended names are non-ASCII.
> > 
> > RFC 1510 cannot safely be used for non-ASCII principal names in any
> > manner that provides interoperability.  If you are using RFC 1510
> > Kerberos, you must stick to ASCII names.
> > 
> > If there was a way to do otherwise, we wouldn't be having this
> > conversation.  
> 
> Right. But isn't a key to this extensibility proposal that you can
> *probe* KDCs in AS exchanges to determine whether they support new
> Kerberos or not?

Of course.  And if the PA_AS_REQ is supported it MUST be used.
And if it isn't supported it MUST be ignored.

Therefore, if the data in the AS_REQ is used it is for RFC 1510
Kerberos and you throw your hands up in the air with regards to
character set handling.

 Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 Beta available
 The Kermit Project @ Columbia University   includes Secure Telnet and FTP
 http://www.kermit-project.org/             using Kerberos, SRP, and 
 [email-masked]          OpenSSL.  SSH soon to follow.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 17 Dec 2001 13:25:25 -0500

> Kerberos and you throw your hands up in the air with regards to

Ah. Thanks. That's what I wanted to hear.

>  Jeffrey Altman * Sr.Software Designer      C-Kermit 8.0 Beta available

Cheers,

Nico
--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.