Subject: CFX Last call comment: section 4.1.1

From: Nicolas Williams <[email-masked]>
Date: Mon, 15 Dec 2003 21:05:07 -0800

Please add the following text to section 4.1.1 and change the checksum
field 0x8003 format table as follows:

   The format of the authenticator checksum field is as follows.

      Octet    Name      Description
     -----------------------------------------------------------------
      0..3    Lgth    Number of octets in Bnd field;  Currently
                      contains hex value 10 00 00 00 (16, represented
                      in little-endian order)
      4..19   Bnd     Channel binding information, as described in
                      section 4.1.1.2.
      20..23  Flags   Four-octet context-establishment flags in little-
                      endian order as described in section 4.1.1.1.
      24..25  DlgOpt  The Delegation Option identifier (=1) [optional]
      26..27  Dlgth   The length of the Deleg field [optional]
      28..n   Deleg   A KRB_CRED message (n = Dlgth + 29) [optional]
+     n+1...  Ext     Extensions
+
+  The receiver MUST ignore any extensions to the checksum 0x8003 data
+  structure.

Cheers,

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 15 Dec 2003 21:15:41 -0800

>    The format of the authenticator checksum field is as follows.

And the corresponding change to section 4.1.1, first paragraph, fourth
sentence:  "The length of the checksum field MUST be at least 24 octets
when delegation is not used, and at least 28 octets, plus Dlgth octets
when delegation is used."

Cheers,

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 16 Dec 2003 16:23:14 -0500

What if I want extensions but do not want delegation?  You should
specify how to do this.