Subject: RE: comments on clarifications

From: "Matt Hur" <[email-masked]>
Date: Sat, 16 Nov 2002 17:05:45 -0800

Cliff, are you ok w/ reflecting this in the draft?

--Matt

> -----Original Message-----
> From: Sam Hartman [mailto:[email-masked]]
> Sent: Saturday, November 16, 2002 3:47 PM
> To: Matt Hur
> Cc: [email-masked]; [email-masked]
> Subject: Re: comments on clarifications
> 
> >>>>> "Matt" == Matt Hur <[email-masked]> writes:
> 
>     Matt> How about we change the text to state that the KDC makes the
>     Matt> decision based on policy and that the policy may be based on
>     Matt> ordinal value?
> 
> I wouldn't feel comfortable with that, but I'd be happy with tstating
> that the KDC SHOULD use the ordered value from the list.  In the
> absence of a good reason to do otherwise, it is useful for a client to
> be able to express preferences about encryption types; I know this is
> mostly useful for debugging, but I have seen some interoperability
> problems where being able to change this order has helped
> significantly.  I can certainly see cases where tradeoffs for specific
> applications might have client-based ordering--for example for doing
> bulk data transfers I might well prefer RC4 to AES, but for
> administrative operations I might prefer AES to RC4.  That distinction
> is likely to be more important for the TGS request than for the AS
> request.
> 
> I certainly agree that a strong policy preference for RC4 over DES and
> existing clients that express the wrong order is sufficient
> justification to violate a SHOULD.
> 
> 
> 
> I'd also recommend that you consider changing the order in future
> versions of your client, although I realize that's a long-term issue.
> 
> You might want to write up an implementation note on this issue as
> well.