Subject: draft-ietf-krb-wg-kerberos-clarifications-04.txt 5.5.1

From: "Joel N. Weber II" <[email-masked]>
Date: Mon, 14 Jul 2003 16:32:02 -0400

I'm confused by this text of clarifications-04 5.5.1:

      When included in the authenticator this field
      specifies the initial sequence number for messages from the client
      to the server. When included in the AP-REP message, the initial
      sequence number is that for messages from the server to the
      client.

Since the authenticator is sent from the client to the server, I don't
understand how a sequence number sent there will protect messages sent
from the client to the server against replays.  Likewise, since AP-REP
goes from the server to the client, I don't see how using it as the
source of the sequence number for messages from the server to the
client is going to protect against a replay.  I believe the text
should be written the other way around.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 14 Jul 2003 14:52:19 -0700

> should be written the other way around.

The initial sequence numbers are protected by the session key.

How is that not enough to setup initial sequence numbers that are not
replayable?

Nico
--