Subject: RE: gssapi-cfx-04.txt section 4.1.1 question

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Tue, 2 Dec 2003 15:37:30 -0800

Douglas E. Engert wrote:
>> The Dlgth field in the checksum is only two bytes long. This may be
to 
>> small should it be 4 bytes? 
>>

The PAC in TGTs does not contain resource groups and it is compressed
correctly since windows 2000 gold, thus the 64K of the ticket size can
contain 1024 domain global groups (the max group # supported by MS) plus
up to roughly 1400 SIDs of history or universal groups in extra SIDs.
For all practical purposes, the 64k limit here is sufficient.  

>> A recent change in Microsoft was to increase the maximum allowed
ticket 
>> size from 8K to 12K indicting that there are now tickets larger then
8K.

This is the SSPI toke size that contains resource groups; this is
usually significantly larger than that of delegation TGTs.

If we can afford it, I would not mind making the delegation length field
4 bytes long, but such seemly benign change would break interoperability
with existing implementations, particularly the initial context
establishment token. 

Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Douglas E.
Engert
Sent: Tuesday, December 02, 2003 1:53 PM
To: Kerberos WG
Subject: gssapi-cfx-04.txt section 4.1.1 question

The Dlgth field in the checksum is only two bytes long. This may be to
small
should it be 4 bytes? 

A recent change in Microsoft was to increase the maximum allowed ticket 
size from 8K to 12K indicting that there are now tickets larger then 8K.

With all the extensions to tickets, I expect we may see tickets large
then 
64K in the future which could not be delegated.

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 2 Dec 2003 15:37:56 -0800

> For all practical purposes, the 64k limit here is sufficient.  

But surely changing that size field to be four octets can't hurt...

> with existing implementations, particularly the initial context

Er, no implementations of CFX have shipped, right?

Nico
--