From: [email-masked]
Date: Thu, 27 Feb 2003 13:10:58 -0600 (CST)

with Microsoft SMTPSVC(5.0.2195.6624);
	 Thu, 27 Feb 2003 10:26:07 -0800
Received: from 157.54.6.150 by INET-VRS-03.redmond.corp.microsoft.com (InterScan E-Mail
VirusWall NT); Thu, 27 Feb 2003 10:26:06 -0800
Received: from RED-IMC-01.redmond.corp.microsoft.com ([157.54.9.102]) by
INET-HUB-05.redmond.corp.microsoft.com with Microsoft SMTPSVC(6.0.3765.0);
	 Thu, 27 Feb 2003 10:26:06 -0800
Received: from WIN-IMC-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.39]) by
RED-IMC-01.redmond.corp.microsoft.com with Microsoft SMTPSVC(5.0.2195.5600);
	 Thu, 27 Feb 2003 10:26:06 -0800
Received: from WIN-MSG-01.wingroup.windeploy.ntdev.microsoft.com ([157.54.0.52]) by
WIN-IMC-01.wingroup.windeploy.ntdev.microsoft.com with Microsoft SMTPSVC(6.0.3765.0);
	 Thu, 27 Feb 2003 10:25:45 -0800
X-MimeOLE: Produced By Microsoft Exchange V6.5.6851.8
Content-class: urn:content-classes:message
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Subject: RE: Unclear behavior for  krb_cred message especially with regard to GSSAPI
Date: Thu, 27 Feb 2003 10:25:47 -0800
Message-ID:
<[email-masked]>
From: "Todd Stecher" <[email-masked]>
To: "Nicolas Williams" <[email-masked]>, "Love" <[email-masked]>
Cc: "Sam Hartman" <[email-masked]>, <[email-masked]>
Sender: [email-masked]

I concur - none of the shipped MS implementations know how to accept /
generate the nonce in the KRB-CRED message, and I can't see the value in
adding it given the encapsulation of the message in AP-REQ.

Thanks,
Todd

On Thursday, February 27, 2003 9:51 AM 
Nicolas Williams [mailto:[email-masked]] wrote:
 
> Hmmm, looking at clarifications:

> - KRB-CRED has no sequence number

>  - KRB-CRED has an optional nonce; this nonce is supposed to be
provided
>    by the KRB-CRED *receipient*, but no mechanism for it to do so is
>   provided!

>  [In the case of RFC1964, there is no way that the receipient can
>  provide such a nonce prior to the client sending its KRB-CRED
>  (because the KRB-CRED is sent within the AP-REQ).]

> - The time fields of KRB-CRED are optional

> Ergo, there is no issue.  The nonce field of the KRB-CRED should just
> not be used in RFC1964 and should be ignored if used.  There is no
> sequence number.

> As for the time fields of KRB-CRED are optional and, in the case of
> RFC1964, redundant, since the enclosing AP-REQ too has time fields
> (non-optional); RFC1964 implementations should not use the time fields
> of KRB-CRED and should probably ignore them when present.

> Cheers,

> Nico

> > On Thu, Feb 27, 2003 at 06:31:30PM +0100, Love wrote:
> > [email-masked] (Sam Hartman) writes:
> > 
> > > Let's assume for the moment that nonces are sequence numbers and
work
> > > the same way as all other sequence numbers.
> > 
> > This seems reasonable, unfortionatly this is not how heimdal does
it.
> >
> > > Should a RFC 1964 krb_cred message include a nonce?  It's sort of
hard
> > > to do because you may be generating the encrypted message body
before
> > > you generate the authenticator.
> >
> > For interop reason it seem it shouldn't include/verify the >
nounce/seqence
> > number. If I understand it correctly should not verify the timestamp
either
> > when used in RFC 1964 ?
> >Love