Subject: Re: [[email-masked]: RE: AP codes 16 and 17]

From: Tom Yu <[email-masked]>
Date: Sat, 12 Oct 2002 12:50:49 -0400

>>>>> "bcn" == Clifford Neuman <[email-masked]> writes:

bcn> Tom,
bcn> We probably want to reserve these application codes 15 and 16 in the
bcn> spec, section 5 an appendix, even though their use is not defined in
bcn> the spec.

I don't think this is acceptable.

"Application code" as used in RFC 1510 is somewhat of a misnomer.  It
appears to refer to two different, but realted things: the application
class tag number used to tag the ASN.1 types used as PDUs (and some
that aren't PDUs), and the content of the msg-type field of most PDUs.
Usually these have the same value for a particular PDU.  I would
vastly prefer that people stop using the term "application code", as
it has no meaning in an ASN.1 context, and its use in RFC 1510 is
potentially misleading.

The potential for havoc is quite large if we allow for specification
of new Kerberos types (by assignment of new tag numbers for new PDUs)
without going through the standards process.  This particular proposed
use is not for further advancement of the Kerberos protocol
specification, nor is it for a standards track protocol.

bcn> From: "Michael Swift" <[email-masked]>
bcn> To: "Clifford Neuman" <[email-masked]>
bcn> Cc: <[email-masked]>

bcn> Cliff -

bcn> I'm unclear on the term "AP code" but I'm assuming it is the message type field.

bcn> AP code 17 is used by user-to-user for the kerb-tgt-reply messages, in which a server sends its tgt to the client.

bcn> AP code 16 is the kerb-tgt-req message, where a client can ask the server for its tgt.

bcn> These are both defined in the user-to-user protocol.
bcn> - - Mike
bcn> - -----Original Message-----
bcn> From: Clifford Neuman [mailto:[email-masked]]
bcn> Sent: Tuesday, October 08, 2002 9:30 PM
bcn> To: Michael Swift
bcn> Subject: AP codes 16 and 17

bcn> Mike,

bcn> A long time ago you asked me to assign some Kerberos identifiers 16
bcn> and 17.  I noted these were ap codes, but I think I mistyped what they
bcn> were.  Since we are zeroing in on krb clarifications, if you can
bcn> remind me what these two codes were for, so that I can add them or at
bcn> least reserve them in the document.

bcn> Cliff
bcn> ----------

Note that if this refers to draft-swift-win2k-krb-user2user-03.txt, it
has been expired for quite some time.  I have previously identified
potential serious problems with the specification of the
KERB-TGT-REQUEST and the KERB-TGT-REPLY messages -- they are SEQUENCE
types with no application tag, and thus indistinguishable to an ASN.1
parser that is incapable of reaching deep inside a SEQUENCE type.  In
my opinion, that makes their present form unsuitable for use as
Kerberos messages.

Since the draft describes the usage of the KERB-TGT-REQUEST and
KERB-TGT-REPLY messages solely in terms of GSSAPI tokens, and these
messages are also not of a form suitable as use as Kerberos messages,
I had proposed that they be considered to be solely used by the u2u
krb5 GSSAPI mechanism extension, which is not standards track.  Their
superficial resemblance to Kerberos messages will only confuse people.

---Tom