Subject: updated: WG last call summary of comments and changes to gssapi-cfx-04.txt

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Wed, 17 Dec 2003 15:01:04 -0800

For
http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-gssapi-cfx-04.txt,

the last call started on 11/26/2003 and ended on 12/15/2003.

Comments received:
   
   11/27/2003 section 4.1.1.1 - Simon Josefsson [[email-masked]]  
        
        Should additional context flag values allowed to be set: 
        GSS_C_ANON_FLAG, GSS_C_PROT_READY_FLAG, GSS_C_TRANS_FLAG 
        
        Editorial issues and IANA considerations.

   12/1/2003 section 5.1.1 - Wyllys Ingersoll [[email-masked]]
  
        Nit on _KRB5_ naming

   12/2/2003 section 4.2 - Sam Hartman [[email-masked]]
      
       Adding text to describe the case when channel bindings are not 
       used by the acceptor

   12/2/2003 section 4.2.6.1 - Sam Hartman [[email-masked]]
 
       MIC token checksum operation needs clarification

   12/2/2003 section 7 - Sam Hartman [[email-masked]]

       Comments on the security consideration section

   12/2/2003 section 4.1.1 - Douglas E. Engert [[email-masked]]
   
       The Dlgth field in the checksum is only two bytes long

   12/2/2003 section 9 - Ken Raeburn [[email-masked]]
    
       Moving [AES-KRB5] to informative references

   12/2/2003 section 5.2 - Douglas E. Engert [[email-masked]]

       16k buffer size, the GSS-API does not impose any restriction
       on the length
   
   12/2/2003 section 4.1.1 - Douglas E. Engert [[email-masked]]

        Can buffer size information be negotiated? How negotiation
        is done

   12/2/2003 Section 4.2.4 - Ken Raeburn [[email-masked]]

        Trailing octets produced by the encrypt/decrypt sequence

   12/2/2003 section 7  - Nicolas Williams [[email-masked]]

        Channels binding in security considerations

   12/3/2003 section 7 - Sam Hartman [[email-masked]]

        Do we want to require that the minimal padding be used?

   12/3/2003 section 5.2 - Martin Rex [[email-masked]]

        must support 16 KB, should support 64 KB and may support       
        larger sizes

   12/3/2003 section 4.2.5 - Sam Hartman [[email-masked]]
  
        Adding "including rotation counts greater than the length 
        of the token." for RRC field

   12/4/2003 section 5.2 - Martin Rex [[email-masked]]
  
        gss_wrap_size_limit() is a local decision (regarding to non

        deterministic cfx padding)

   12/15/2003 section 4.2.5 - Sam Hartman [[email-masked]]
   
        Extensibility and GSSAPI-CFX

   12/15/2003 section 4.1.1 - Nicolas Williams
[[email-masked]]

        Extensions field and reserve one flag bit for future extensions

   12/15/2003 section 4.1 - Nicolas Williams [[email-masked]]
      
        Remove the last paragraph of section 4.1

   12/16/2003 section 4.1.1 - Nicolas Williams
[[email-masked]]
      
       Reserve flags for the DCE style and anything else that is MS-
       specific

Changes:

  Section  What is changed
  -----------------------------------
  4.1.1.1  Added "extensions" to the end of checksum (new text posted 
           to the list), tentatively
           
  4.1.1.1  checksum flags field, changed to reserve bit 12 through 19 
           Inclusive, to cover the DCE_STYLE flag, etc

  4.1.1.2  added the channel binding paragraph Sam posted on 12/2/2003 
  
  4.2.4    added clarification for "crypto garages" and removed "next" 
           size
  
  4.2.5    added "including rotation counts greater than the length of 
           the token."

  4.2.6.1  changed to checksum the header last for MIC tokens
 
  5.2      buffer size support: "16k MUST, 64k SHOULD, larger MAY"

  7        added security consideration for channel bindings (new text 
           posted to the list)
  
  9        moved AES-KRB5 into informative references

Thx, Larry