Subject: RE: questions on bcn's issue list

From: [email-masked]
Date: Fri, 19 Apr 2002 09:46:09 -0700

Works for me. Thanx.

-----Original Message-----
From: Clifford Neuman [mailto:[email-masked]] 
Sent: Friday, April 19, 2002 8:15 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: questions on bcn's issue list

   Date: Thu, 18 Apr 2002 15:08:56 -0400 (EDT)
   From: [email-masked] (Sam Hartman)

   I want to amke sure that when I write text to give to Cliff, I write
   something that represents the consensus of the group.

   For KDC replay  caches.  Did we agree that even for TCP, a KDC should
   return a packet from its look aside cache rather than a replay error?

Yes, that is what we agreed.  The behavior will be the same for TCP
and UDP.  To answer John's question, no we do not drop the replay
detected error.   We use the cache when the request is identical.  If
the request is not identical, but uses the same authenticator (in a
TGS request), then we return the error.

The above is my understanding.  Please correct me if someone thinks we
decided otherwise.

Cliff

---

From: [email-masked]
Date: Fri, 19 Apr 2002 11:32:00 -0700

<[email-masked]>
Thread-Topic: questions on bcn's issue list
Thread-Index: AcHntOn04sPNJF1fRBKtKBNujOQPlQAG+F4A
From: "John Brezak" <[email-masked]>
To: "Clifford Neuman" <[email-masked]>, <[email-masked]>
Cc: <[email-masked]>
X-OriginalArrivalTime: 19 Apr 2002 18:32:16.0290 (UTC) FILETIME=[87EF3820:01C1E7D0]
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by atalanta.ctd.anl.gov id NAA16789
Sender: [email-masked]
Precedence: bulk

What are you checking in the (TGS) request to judge if they are
identical with the same authenticator?

-----Original Message-----
From: Clifford Neuman [mailto:[email-masked]] 
Sent: Friday, April 19, 2002 8:15 AM
To: [email-masked]
Cc: [email-masked]
Subject: Re: questions on bcn's issue list

Cliff

---

From: Sam Hartman <[email-masked]>
Date: Fri, 19 Apr 2002 15:09:56 -0400

>>>>> "John" == John Brezak <[email-masked]> writes:

    John> What are you checking in the (TGS) request to judge if they
    John> are identical with the same authenticator?

The TGS request is a special case of an ap-req.  If it is not
bit-for-bit identical and the authenticator is a replay then you get a
replay error.