Subject: Comments on draft-brezak-win2k-krb-authz-00.txt

From: Luke Howard <[email-masked]>
Date: Sat, 30 Nov 2002 15:02:33 +1100

The following is unclear to me with respect to Section 5.,
Signatures.

1. "The data portion of both checksums is zeroed." Does this
   include the SignatureType field of PAC_SIGNATURE_DATA, or
   just the Signature field? Presumably the SignatureType
   could be set before the PAC is signed.

2. "The server's checksum is then checksummed with the KDC's
   key." Again, is the server's checksum the Signature field
   or the entire PAC_SIGNATURE_DATA?

3. For draft-brezak-win2k-krb-rc4-hmac-04.txt checksums,
   what key derivation salt is to be used when generating the
   PAC signatures?

-- Luke

--
Luke Howard | PADL Software Pty Ltd | www.padl.com