Subject: RE: Checksum flags field (section 4.1.1.1) in gssapi-cfx-04

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 1 Dec 2003 10:45:51 -0800

Is it meaningful to set GSS_C_TRANS_FLAG? Would the acceptor behave
differently if this bit is set?

Simon Josefsson wrote:
>> Are these allowed to be set by implementations that support them?
>> Are receivers forced to ignore them if they are set?

Yes, this document does not prohibit setting additional flags.

The receivers are not forced to ignore the flags that are not listed in
this document, for example, they might know other flags that are defined
in a future document.

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Simon
Josefsson
Sent: Thursday, November 27, 2003 6:16 AM
To: Douglas E. Engert
Cc: Kerberos WG; Russell Housley; Steven M. Bellovin
Subject: Checksum flags field (section 4.1.1.1) in gssapi-cfx-04

RFC 2744 define the following flags as well:

   #define GSS_C_ANON_FLAG       64
   #define GSS_C_PROT_READY_FLAG 128
   #define GSS_C_TRANS_FLAG      256

Are these allowed to be set by implementations that support them?
Are receivers forced to ignore them if they are set?

One editorial issues: The document reserve certain bit sequences in
several places (4.1.1.1, 4.2.2, and 4.4).  Because some of these texts
appear to be directed to IANA or IETF (e.g., section 4.4 "Token
identifiers ... are reserved and SHALL NOT be assigned."), and not to
protocol implementors, I think they should placed in a separate
section.

Thanks,
Simon

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 1 Dec 2003 10:34:07 -0800

> protocol implementors, I think they should placed in a separate

Curtsey of [email-masked]: The TOK_ID values aren't used outside this
mechanism, and they're not intended as a way for other people to extend
the protocol.  Since new ones should only be allocated as part of
specifying a future version of the mechanism (which will presumably
obsolete this version, or at least update it), I don't think an IANA
registry is necessary.  This WG is already creating lots of work for
IANA; let's not invent more where it doesn't need to exist.

Similarly, I do not think we need work for IANA for the checksum flags.

Thanks,

Larry
-----Original Message-----

Thanks,
Simon