Subject: client name and realm in authenticator

From: Jonathan Trostle <[email-masked]>
Date: Wed, 28 Aug 2002 12:59:27 -0400 (EDT)

When validating the ap-req, the server checks that the client name and 
realm in the authenticator matches the same fields in the ticket. What is
the reason for this check, given that the session key already binds the
authenticator to the ticket?

Thanks,
Jonathan

---

From: Sam Hartman <[email-masked]>
Date: Wed, 28 Aug 2002 14:48:21 -0400

>>>>> "Jonathan" == Jonathan Trostle <[email-masked]> writes:

    Jonathan> When validating the ap-req, the server checks that the
    Jonathan> client name and realm in the authenticator matches the
    Jonathan> same fields in the ticket. What is the reason for this
    Jonathan> check, given that the session key already binds the
    Jonathan> authenticator to the ticket?

If u propose relaxing this requirement you should convince me that
no attack is possible rather than the other way around.  Recent
experience has underscored in my mind the importance of doing
extensive verification of data in security protocols.