Subject: Clarifications: When should an error b e returned for wrong app tag?

From: [email-masked] (Sam Hartman)
Date: Mon, 5 Jan 2004 17:45:48 -0500 (EST)

Section 5.1.4 of Kerberos clarifications claims that implementations
should return an error for unknown tags if appropriate.  The IESG (in
the person of Steve) claims this text is ambiguous and we should
clarify what is appropriate.

I propose that the KDC return an error for TCP, but not for UDP.  The
error should not be returned for UDP because of potential DOS issues.

For other applications, the Kerberos implementation should return an
error to the application which can perform application-specific error
handling.