Subject: [nfsv4] confused about QOP

From: "J. Bruce Fields" <[email-masked]>
Date: Sun, 9 Oct 2005 11:35:08 -0400

We're looking at implementing some more of the krb5 encryption
algorithms.  The rfc describing the new krb5 gssapi tokens (rfc 4121)
says:

	"The GSS-API specification [RFC2743] provides Quality of
	Protection (QOP) values that can be used by applications to
	request a certain type of encryption or signing.  A zero QOP
	value is used to indicate the "default" protection; applications
	that do not use the default QOP are not guaranteed to be
	portable across implementations, or even to inter-operate with
	different deployment configurations of the same implementation.
	Using a different algorithm than the one for which the key is
	defined may not be appropriate.  Therefore, when the new method
	in this document is used, the QOP value is ignored."

Also, the older rfc 1964 defines nonzero QOP values only for a few
signing algorithms.

So, if we just want to implement krb5 with AES, 3DES, etc., am I correct
to believe that we're just going to be using QOP of zero and doing the
negotiation within kerberos?

Are there (or are there expected to be) any NFSv4 servers that will
ever return a nonzero value in the QOP fields of the secinfo lists?

--b.

_______________________________________________
nfsv4 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/nfsv4