Subject: [Ietf-krb-wg] enctype result of krb-fx-cf2

From: Sam Hartman <[email-masked]>
Date: Thu, 22 Jan 2009 15:04:13 -0500

enctype is.

We use this function in the anonymous draft.  In that case it seems
like we want the enctype of the session key to be the same as the
enctype of k1 (the kdc contribution key).

That actually seems like a fine rule to me.  So, I propose to amend
section 6.1 of the preauth framework to say that unless otherwise
specified, the enctype of the resulting key is the same as k1.  I'd
also be happy to drop "unless otherwise specified."

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Thu, 22 Jan 2009 16:10:42 -0500

<[email-masked]> wrote:

>
>
> The specification of krb-fx-cf2 does not say what the resulting
> enctype is.

Well, of course not.  It's constructed such that it doesn't matter, so long 
as you use the correct enctype's random-to-key.  I don't see any reason why 
this needs to change; instead, change the place(s) where krb-fx-cf2 is 
_used_ to specify how to determine the enctype of the key to be generated.

> also be happy to drop "unless otherwise specified."

I think a rule like this, with the "unless otherwise specified", would be a 
fine way to reduce the likelyhood of producing an underspecified protocol 
at some point in the future.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg