Subject: Re: kerberos 5 GSS-API mechanism GetMIC() tokens

From: "Ron Hoffman" <[email-masked]>
Date: Sun, 12 May 2002 08:47:50 -0400

Bruce,

According to my copy of RFC 1964 (June 1966), the GSS-API framing will
be used on all tokens.  The SPKM and LIPKEY mechanisms do this as well.
The message data as described in each section of the RFC is then the
innerContextToken.

Ron Hoffman ([email-masked])

-   Per RFC-1508, Appendix B, the initial context establishment token
-   will be enclosed within framing as follows:

-   InitialContextToken ::=
-   [APPLICATION 0] IMPLICIT SEQUENCE {
-           thisMech        MechType
-                   -- MechType is OBJECT IDENTIFIER
-                   -- representing "Kerberos V5"
-           innerContextToken ANY DEFINED BY thisMech
-                   -- contents mechanism-specific;
-                   -- ASN.1 usage within innerContextToken
-                   -- is not required
-           }

-   The innerContextToken of the initial context token will consist of a
-   Kerberos V5 KRB_AP_REQ message, preceded by a two-byte token-id
-   (TOK_ID) field, which shall contain the value 01 00.

-   The above GSS-API framing shall be applied to all tokens emitted by
-   the Kerberos V5 GSS-API mechanism, including KRB_AP_REP, KRB_ERROR,
-   context-deletion, and per-message tokens, not just to the initial
-   token in a context establishment sequence.  While not required by
-   RFC-1508, this enables implementations to perform enhanced error-
-   checking. The innerContextToken field of context establishment
tokens
-   for the Kerberos V5 GSS-API mechanism will contain a Kerberos
message
-   (KRB_AP_REQ, KRB_AP_REP or KRB_ERROR), preceded by a 2-byte TOK_ID
-   field containing 01 00 for KRB_AP_REQ messages, 02 00 for KRB_AP_REP
-   messages and 03 00 for KRB_ERROR messages.

---

From: "J. Bruce Fields" <[email-masked]>
Date: Mon, 13 May 2002 13:58:15 -0400

> The message data as described in each section of the RFC is then the

You are completely correct.  Somehow I missed the sentence "The above
GSS-API framing shall be applied to all tokens..." below.

Thanks.---Bruce F.