Subject: keying issue with ID GSSAPI-CFX

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Fri, 15 Apr 2005 13:33:55 -0700

GSSAPI-CFX does not clearly specify what the base key is when the client
asserts a subkey in the AP-REQ. 

I propose to change the last paragraph of section 2 to:

  During the context initiation and acceptance sequence, the acceptor
MAY
  assert a subkey in the AP-REP message.  If the acceptor asserts a
subkey,
  the base key is the server-asserted subkey and subsequent per-message
  tokens MUST be flagged with "AcceptorSubkey" as described in section 
  4.2.2.  Otherwise, if the client asserts a subkey in the AP-REQ
message, 
  the base key is this subkey;  if the client does not assert a subkey,
the 
  base key is the session key in the service ticket.  

This is basically everybody implements today. I am asking the group if
we can clarify this in the author's last 48 hours.

Thanks,

-- Larry

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 18 Apr 2005 18:30:43 -0500

> we can clarify this in the author's last 48 hours.

I support this.

---

From: Sam Hartman <[email-masked]>
Date: Mon, 18 Apr 2005 20:58:24 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Fri, Apr 15, 2005 at 01:33:55PM -0700, Liqiang(Larry)
    Nicolas> Zhu wrote:
    >>  GSSAPI-CFX does not clearly specify what the base key is when
    >> the client asserts a subkey in the AP-REQ.
    >> 
    >> During the context initiation and acceptance sequence, the
    >> acceptor MAY assert a subkey in the AP-REP message.  If the
    >> acceptor asserts a subkey, the base key is the server-asserted
    >> subkey and subsequent per-message tokens MUST be flagged with
    >> "AcceptorSubkey" as described in section 4.2.2.  Otherwise, if
    >> the client asserts a subkey in the AP-REQ message, the base key
    >> is this subkey; if the client does not assert a subkey, the
    >> This is basically everybody implements today. I am asking the
    >> group if we can clarify this in the author's last 48 hours.

    Nicolas> I support this.

As do I; I didn't notice whether Larry mentioned this in his original
mail.

--Sam