Subject: Comments on draft-brezak-win2k-krb-rc4-hmac-04.txt

From: Luke Howard <[email-masked]>
Date: Sat, 30 Nov 2002 15:01:14 +1100

With regard to draft-brezak-win2k-krb-rc4-hmac-04.txt:

1. In Section 8.3 (GSSAPI WRAP semantics), "seq" is undefined:

        // new encryption key salted with seq
        Kcrypt = HMAC(Kcrypt, (int32)seq);

   Presumably this is the big-endian sequence number (Token.SEND_SEQ)
   but this should be clarified, particularly given that elsewhere
   little endian salts are used.

2. Should not the padding for exportable keys be nine, not
   seven, bytes for the effective key length to be 56 bits?

        memset(Kcrypt+7, 0xab, 9);

   vs.
      
        memset(Kcrypt+7, 0xab, 7);

   This applies to section 8.2 as well as 8.3.

3. Windows 2000 clients appear to send eight bytes of padding in
   DCE RPC PDUs when using GSS-API (GSS_C_DCE_STYLE), even with using
   the GSS_Wrap() mechanism specified in rc4-hmac. Has anyone else
   attempted to implement an interoperable GSS-API / SPNEGO DCE
   authentication provider?

-- Luke

--
Luke Howard | PADL Software Pty Ltd | www.padl.com