Subject: RE: gssapi-cfx-04.txt section 4.1.1 question

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 15 Dec 2003 21:20:01 -0800

Doug, where do you stand now for having the upper limit of 64k for the
delegation credential message?

Larry

-----Original Message-----
From: Nicolas Williams [mailto:[email-masked]] 
Sent: Monday, December 15, 2003 9:01 PM
To: Sam Hartman
Cc: Liqiang(Larry) Zhu; Douglas E. Engert; Kerberos WG; JK Jaganathan
Subject: Re: gssapi-cfx-04.txt section 4.1.1 question

On Mon, Dec 15, 2003 at 02:08:42PM -0500, Sam Hartman wrote:
> >>>>> "Liqiang(Larry)" == Liqiang(Larry) Zhu
<[email-masked]> writes:
> 
>     Liqiang(Larry)> Is the consensus to use 4 bytes to encode Dlgth,
>     Liqiang(Larry)> but do we need to change the checksum type, say
>     Liqiang(Larry)> change it to 0x8004, in that case? It does make
>     Liqiang(Larry)> sense to me if we end up changing the encoding
>     Liqiang(Larry)> and/or the content of the GSS authenticator
>     Liqiang(Larry)> checksum.
> 
> I thought you objected to changing the initial context tokens because
that prevents you from negotiating up.

If Larry's objection to changing the initial context tokens stands then
we should go back to a two-octet delegated credential field.

Nico
--

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 15 Dec 2003 21:17:27 -0800

Larry, also note my reply to Sam on extensibility and my last call
comments just posted on the context flags and checksum data length.

If we agree on how to extend CFX (perhaps as I propose), then we can
always extend CFX when the time for tickets >64KB comes.

Nico

---

From: "Douglas E. Engert" <[email-masked]>
Date: Tue, 16 Dec 2003 09:06:57 -0600

> delegation credential message?

If you feel that this length is adequate for the near term, i.e. till
and extended CFX is available, then a 64K limit is OK with me. Its your
company that is creating the very large tickets. 
 
I do like Nico's suggestion of reserving a bit in the flags specifically 
for future extensions. This would appear to not require any code changes,
just reserve it now.  

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Tue, 16 Dec 2003 16:24:41 -0500

Note that if Nico's comments on CFX extensibility are adopted I have
no problem increasing delegation length at this time.  I'm just
surprised Larry is willing to go along.