Subject: Making sure WG clarifications comments are reflected

From: [email-masked] (Sam Hartman)
Date: Tue, 4 Nov 2003 14:30:02 -0500 (EST)

Since the WG last call there have been a few comments within the WG; I
know we discovered at least one error in September.  Is someone
responsible for making sure these comments get forwarded to the IESG?

Did all the comments even make it to the list here?

---

From: Simon Josefsson <[email-masked]>
Date: Fri, 07 Nov 2003 00:46:54 +0100

I can't tell whether this comment has been acted upon.

Thanks,
Simon

From: Simon Josefsson <[email-masked]>
Subject: kerberos-clarifications-04 section 5.9 editorial fixes
To: Ken Raeburn <[email-masked]>, Sam Hartman <[email-masked]>
Date: Wed, 27 Aug 2003 08:57:42 +0200

The "amKRB-ERROR" and "+A" looks like typos. srealm in the explanation
part is a typo, it should be realm.  The 5.4.1 reference for ctime is
wrong, use 5.5.2.

The descriptions for ctime and cusec should preferably also say (if
this is intended) that the ctime and cusec fields should be populated
using the ctime and cusec fields in the request, when available.  It
could also say that if ctime and cusec is not available in the
request, those fields should not be present.  Otherwise, the meaning
of those fields are not well defined enough to be useful, IMHO.

Same holds for crealm, cname, realm, and sname, although it seems more
complicated to give a complete discussion: not all requests contain
those fields, and some contain more than one occurrence.

Also, values for realm and sname are not always available (consider if
the incoming message is not understood at all), it could be useful to
suggest that an application should use empty realm, the KRB_NT_UNKNOWN
sname name type and empty sname name-string sequence in that case.
Alternatively, mark realm and sname OPTIONAL in the ASN.1 module.

Proposed new text:

   ctime, cusec
      These fields are described above in section 5.5.2.  If the
      values for these fields are known to the entity generating the
      error (such as it would if the KRB-ERROR is generated in reply
      to, e.g., an failed authentication service request), it should
      be populated in the KRB-ERROR.  If the values are not available,
      these fields can be removed.

   crealm, cname, realm and sname
      These fields are described above in section 5.3.  When the
      entity generating the error know these values, the should be
      populated in the KRB-ERROR.  If the values are not known, the
      crealm and cname fields can be removed, the realm could be set
      to the empty string, and the sname set to the KRB_NT_UNKNOWN
      name type and an empty name-string SEQUENCE.

Thanks.