Subject: [Ietf-krb-wg] Use of Iteration Count in OTP Pre-Auth

From: "Richards, Gareth" <[email-masked]>
Date: Mon, 14 Jan 2008 10:22:37 -0000

Following a discussion on list, version 01 of
draft-ietf-krb-wg-otp-preauth supports using a hash of the OTP value in
the key generation.  The KDC sends a list of hash algorithms and an
iteration count to the client.  The client selects an algorithm and
sends the selected algorithm along with the iteration count used back to
the KDC in the response.

Currently, the I-D states that the iteration count used by the client
MUST be equal to that specified in the KDC challenge.  Following
discussions off-list, I think that this should be changed so that the
value used by the client MUST NOT be less.  

--Gareth
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg