Subject: RE: Correct response from KDC for wrong protocol version

From: "John Brezak" <[email-masked]>
Date: Mon, 7 Jan 2002 16:47:34 -0800

This is consistent with the MIT KDC behavior. When would it be
beneficial for the KDC to reply with the KDC_ERR_BAD_PVNO ? I can't see
when it is useful especially since the error doesn't suggest what are
good pvnos for the KDC.

I'd prefer removing the KDC_ERR_BAD_PVNO completely and stating that the
KDC MUST NOT reply with anything if the pvno is not 5. 

> -----Original Message-----
> From: Jeffrey Hutzelman [mailto:[email-masked]] 
> Sent: Monday, January 07, 2002 3:28 PM
> To: John Brezak
> Cc: [email-masked]
> Subject: Re: Correct response from KDC for wrong protocol version
> 
> 
> On Thu, 3 Jan 2002, John Brezak wrote:
> 
> > What should the KDC do when a request is received with the wrong 
> > protocol version?
> >  
> > It appears that the MIT KDC does not respond if the request pvno is 
> > not 5. However there is an error defined for KDC_ERR_BAD_PVNO in 
> > kerberos-revisions. Since the error is defined, the KDC 
> might want to 
> > return it.
> >  
> > No response for versions <5 can be a good thing. However using the 
> > error for a request >5 can help with future compat issues.
> >  
> > The pseudo-code doesn't indicate what to do in this case either.
> >  
> > Thoughts?
> 
> I certainly think we should define the behaviour.  Perhaps 
> the KDC MAY send a KDC_ERR_BAD_PVNO but MUST NOT send any 
> other response?  I don't think we need to worry too much 
> about compatibility with other versions. The pvno fields are 
> unlikely to _ever_ contain anything other than 5, because 
> they are placed such that they can't be used effectively as a 
> protocol version.  Note that older versions of Kerberos used 
> a completely different wire format.
> 
> -- Jeff
> 
>

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 7 Jan 2002 20:02:22 -0500 (EST)

> KDC MUST NOT reply with anything if the pvno is not 5. 

It would be beneficial to allow the KDC to reply with the error if there
are any existing KDC's that do this.