Subject: questions on bcn's issue list

From: [email-masked] (Sam Hartman)
Date: Thu, 18 Apr 2002 15:08:56 -0400 (EDT)

I want to amke sure that when I write text to give to Cliff, I write
something that represents the consensus of the group.

For KDC replay  caches.  Did we agree that even for TCP, a KDC should
return a packet from its look aside cache rather than a replay error?

---

From: Clifford Neuman <[email-masked]>
Date: Fri, 19 Apr 2002 08:14:32 -0700 (PDT)

Date: Thu, 18 Apr 2002 15:08:56 -0400 (EDT)
   From: [email-masked] (Sam Hartman)

Yes, that is what we agreed.  The behavior will be the same for TCP
and UDP.  To answer John's question, no we do not drop the replay
detected error.   We use the cache when the request is identical.  If
the request is not identical, but uses the same authenticator (in a
TGS request), then we return the error.

The above is my understanding.  Please correct me if someone thinks we
decided otherwise.

Cliff