Subject: [Ietf-krb-wg] kdc-model-12 - enctypes

From: Zhanna Tsitkov <[email-masked]>
Date: Wed, 6 Jun 2012 10:17:23 -0400

Hi,
In section 4.1.1.13 (principalAllowedEnctype) one reads:
"If empty or absent any enctype supported by the implementation is  
allowed for this Principal".
The problem here is that the "implementation" may have a wide range of  
the enctypes, say, the flavors of des, aes, camellia. On the other  
hand, KDC might be configured to use only aes, meaning that neither  
des nor camellia would not be allowed for this Principal. right?

Also, this revision is still missing the explicit reference to "time  
and date" in the sections 4.1.1.2 (principalNotUsedBefore), 4.1.1.3  
(principalNotUseAfter), 4.3.1.5 (keyNotUsedBefore) and 4.3.1.6  
(keyNotUsedAfter).

Thanks,
Zhanna

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Sam Hartman <[email-masked]>
Date: Wed, 06 Jun 2012 11:03:41 -0400

>>>>> "Zhanna" == Zhanna Tsitkov <[email-masked]> writes:

    Zhanna> Hi,
    Zhanna> In section 4.1.1.13 (principalAllowedEnctype) one reads:
    Zhanna> "If empty or absent any enctype supported by the implementation is
    Zhanna> allowed for this Principal".
    Zhanna> The problem here is that the "implementation" may have a wide range of
    Zhanna> the enctypes, say, the flavors of des, aes, camellia. On the other
    Zhanna> hand, KDC might be configured to use only aes, meaning that neither
    Zhanna> des nor camellia would not be allowed for this Principal. right?

I certainly assume that's what is intended. One easy fi x would be to
replace supported with permitted.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Leif Johansson <[email-masked]>
Date: Thu, 07 Jun 2012 09:55:13 +0200

On 06/06/2012 05:03 PM, Sam Hartman wrote:
> Zhanna> Hi, Zhanna> In section 4.1.1.13 (principalAllowedEnctype)
> one reads: Zhanna> "If empty or absent any enctype supported by the
> implementation is Zhanna> allowed for this Principal". Zhanna> The
> problem here is that the "implementation" may have a wide range of 
> Zhanna> the enctypes, say, the flavors of des, aes, camellia. On
> the other Zhanna> hand, KDC might be configured to use only aes,
> meaning that neither Zhanna> des nor camellia would not be allowed
> for this Principal. right?
> 
> I certainly assume that's what is intended. One easy fi x would be
> to replace supported with permitted.

Sounds good.