Subject: Re: [Ietf-krb-wg] Review draft-ietf-krb-wg-anon-04.txt

From: Larry Zhu <[email-masked]>
Date: Sun, 27 Jan 2008 10:10:40 -0800

Love Hörnquist Åstrand wrote:
> Split the AS and TGS descriptions in diffrent sub sections for
> readablity and overview.

I prefer not to repeat the same text in two sections.

> The text is in the "TGS section" (quoted below), I assume this apply
> to the AS section.
> Its kind of strange to define how older code that exists before this
> draft is
> supposed to work.

This is not the draft it is telling us. Because the anonymous principal does not have a shared private key with the KDC, the KDC reply key need to be constructed in some way, and it hints (in a non-obvious way I admit) that PKINIT can be used to construct the KDC reply key.

> Edata for TGS error case, I think it should be allowed. If not it
> should be motivated why not (extentiblity ?).

Because this ID is defining a new error code, and because the interpretation of the EData is based on the error code, and because this document introduces a new code, it points out there is no edata defined for this new error code in this document. It does not imply that EData is not allowed.

Thanks,

--larry
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Thursday, December 06, 2007 6:49 PM
To: [email-masked]
Subject: [Ietf-krb-wg] Review draft-ietf-krb-wg-anon-04.txt

I read over the document today and found these issues:

Split the AS and TGS descriptions in diffrent sub sections for
readablity and overview.

The text is in the "TGS section" (quoted below), I assume this apply
to the AS section.
Its kind of strange to define how older code that exists before this
draft is
supposed to work.

    "If the client is anonymous and the KDC does not have a key to
encrypt
    the reply (this can happen when, for example, the KDC does not
    support PKINIT [RFC4556]), the KDC MUST return an error message with
    the code KDC_ERR_NULL_KEY [RFC4120] and there is no accompanying
    e-data defined in this document."

Edata for TGS error case, I think it should be allowed. If not it
should be motivated why not (extentiblity ?).

Love

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg