Subject: Correct response from KDC for wrong protocol version

From: "John Brezak" <[email-masked]>
Date: Thu, 3 Jan 2002 15:55:05 -0800

What should the KDC do when a request is received with the wrong
protocol version?
 
It appears that the MIT KDC does not respond if the request pvno is not
5. However there is an error defined for KDC_ERR_BAD_PVNO in
kerberos-revisions. Since the error is defined, the KDC might want to
return it.
 
No response for versions <5 can be a good thing. However using the error
for a request >5 can help with future compat issues.
 
The pseudo-code doesn't indicate what to do in this case either.
 
Thoughts?

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

John Brezak                       * mailto:[email-masked]

Microsoft Corporation        ( 425-706-2602

One Microsoft Way

Redmond, WA 98052

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 7 Jan 2002 18:28:17 -0500 (EST)

> The pseudo-code doesn't indicate what to do in this case either.

I certainly think we should define the behaviour.  Perhaps the KDC MAY
send a KDC_ERR_BAD_PVNO but MUST NOT send any other response?  I don't
think we need to worry too much about compatibility with other versions.
The pvno fields are unlikely to _ever_ contain anything other than 5,
because they are placed such that they can't be used effectively as a
protocol version.  Note that older versions of Kerberos used a completely
different wire format.

-- Jeff