Subject: [Fwd: Comments on draft-ietf-krb-wg-kerberosw-clarifications-04.txt dated June 19, 2001]

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 06 Nov 2003 16:32:11 -0600

-------- Original Message --------
Subject: Comments on draft-ietf-krb-wg-kerberosw-clarifications-04.txt dated June 19, 2001
Date: Thu, 6 Nov 2003 16:09:17 -0500
From: [email-masked]
To: [email-masked]

Here are my comments, this time hopefully in clear text.  I'd rather not
join the mailing list at this time.  The reason that I was originally at the
RFC and then at the draft was to try and understand what I was seeing in
network traces in trying to solve a problem.  The second item below was the
area that really of my main concern.  In the pseudo code of the RFC as well
as in Section 3.1.5, it certainly looked as though the principal name sent
in the request must be returned in the reply.  The addition of the
patenthetical remark says that this is not so, but I am trying to understand
the differences that are allowed.  

1)  Section 3.3.3 -  Second Paragraph - Last Sentence
There are typos in this sentence.  "Thss" should be "This" and "theonly"
should be "the only".

2)  Section 3.1.5 - Third Paragraph
The phrase "(or otherwise expected values)" appears to be ambiguous.  What
expected values.  May the name type change between the KRB_TGS_REQ and the
KRB_TGS_REP messages?  May the service name change between these messages?
For clarity, I would hope that any limitations in differences in these
fields between the request and the reply be specifically outlined.  

Joseph I. Wiesenfeld
Senior Network Engineer
EMC2
where information lives
Phone:  508-249-8708
Email:  [email-masked]

---

From: Sam Hartman <[email-masked]>
Date: Thu, 06 Nov 2003 18:14:57 -0500

>>>>> "Douglas" == Douglas E Engert <[email-masked]> writes:
    Douglas> 2) Section 3.1.5 - Third Paragraph The phrase "(or
    Douglas> otherwise expected values)" appears to be ambiguous.
    Douglas> What expected values.  May the name type change between
    Douglas> the KRB_TGS_REQ and the KRB_TGS_REP messages?  May the
    Douglas> service name change between these messages?  For clarity,
    Douglas> I would hope that any limitations in differences in these
    Douglas> fields between the request and the reply be specifically
    Douglas> outlined.

They should be.  I think the intent of that remark is to imply that
future extensions to the protocol may allow such changes.  But unless
you use one of these extensions, the principal name should not change.

I don't think Microsoft's implementation conforms to this strictly.
In particular, I believe there are cases where Microsoft chooses to
return a response with changed principal name rather than an error.