Subject: RE: gssapi-cfx-04.txt section 4.1.1 question

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 15 Dec 2003 11:06:17 -0800

Is the consensus to use 4 bytes to encode Dlgth, but do we need to
change the checksum type, say change it to 0x8004, in that case? It does
make sense to me if we end up changing the encoding and/or the content
of the GSS authenticator checksum.

To summarize, the main reason that convinced me that this change was
needed was that we could end up adding very large ticket extensions.

Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Tuesday, December 02, 2003 10:42 PM
To: Liqiang(Larry) Zhu
Cc: Douglas E. Engert; Kerberos WG
Subject: Re: gssapi-cfx-04.txt section 4.1.1 question

On Tue, Dec 02, 2003 at 04:19:27PM -0800, Liqiang(Larry) Zhu wrote:
> Nicolas.Williams wrote:
> >> But surely changing that size field to be four octets can't hurt...
> >> Er, no implementations of CFX have shipped, right?
> 
> The task of negotiation (to use CFX) is given to KDCs as suggested by
> this document; if we want to do CFX with down level KDCs (but between
> upper level initiators and acceptors) we need to maintain the same
token
> format in the initial token.

Huh?  No, no.  This is not what we'd agreed to.

Negotiation between CFX and rfc1964 is to be done at the KDC exchanges
or through some other out-of-band mechanism - that was the agreement.
Keeping any CFX tokens interoperably compatible with rfc1964 tokens was
not an explicit goal.

> It is possible, however, to change the delegation length field if the
> KDC understands "newer enctyes", and in that case only.

This is a [partial] restatement of our previous agreement.

>                                                         Is it worth
the
> trouble given the size of TGTs is unlikely to exceed 64k in any
> foreseeable future?

There is no trouble.  And yes, no trouble is worth this change.  With
future extensions tickets may grow quite large for all we know now.
Let's not do the 640KB thing again.

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Mon, 15 Dec 2003 14:08:42 -0500

>>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu <[email-masked]> writes:

    Liqiang(Larry)> Is the consensus to use 4 bytes to encode Dlgth,
    Liqiang(Larry)> but do we need to change the checksum type, say
    Liqiang(Larry)> change it to 0x8004, in that case? It does make
    Liqiang(Larry)> sense to me if we end up changing the encoding
    Liqiang(Larry)> and/or the content of the GSS authenticator
    Liqiang(Larry)> checksum.

I thought you objected to changing the initial context tokens because that prevents you from negotiating up.

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 15 Dec 2003 21:00:59 -0800

> I thought you objected to changing the initial context tokens because that prevents you from negotiating up.

If Larry's objection to changing the initial context tokens stands then
we should go back to a two-octet delegated credential field.

Nico
--