Subject: RE: Comments on draft-ietf-krb-wg-kerberos-clarifications-00.txt

From: "John Brezak" <[email-masked]>
Date: Mon, 11 Mar 2002 14:07:43 -0800

Another point to consider. The order is specified in the clear. A MITM
can influence the choice.

A scenario where the client may have a better opinion is when the
client's computer has hardware acceleration available for certain
enctypes.

However, I believe that the KDC would need to know that the client's
computer favors certain enctypes based on some out-of-band mechanism (in
the KDB for the computer), and the computer that is being used for the
request is authenticated and identifiable in the KDC-MSG.

I still prefer the selection of a suitable enctype to be a local policy
issue that is best left to the KDC.

-----Original Message-----
From: Sam Hartman [mailto:[email-masked]] 
Sent: Monday, March 11, 2002 1:55 PM
To: Ken Hornstein
Cc: John Brezak; [email-masked]; [email-masked]
Subject: Re: Comments on
draft-ietf-krb-wg-kerberos-clarifications-00.txt

>>>>> "Ken" == Ken Hornstein <[email-masked]> writes:

    >> O, everyone involved seems to agree that if a key does not meet
    >> KDC policy the KDC should not use it.  The question is whether
    >> among the set of keys that do meet policy, the KDC or client
    >> should specify the preference order.

    Ken> .... I'm going to have to side with John and vote for the KDC
    Ken> to do that (even though I know we're not voting).  I
    Ken> understand what you were saying about an application having
    Ken> better knowledge about it's needs ... but in the majority of
    Ken> applications I've dealt with, the encryption algorithm is
    Ken> mostly arbitrary ... any one of them could fit.  Central
    Ken> management of a preference order would be a huge win for
    Ken> those applications.

You keep asserting this.  Mind justifying the assertion?  Intuitively I
tend to agree with you, but in the few situations I've actually seen it
matter, it was very useful to have the client specify the preference
order.  I can't really think of situations where having the KDC specify
preference order for session keys would ever help me.