Subject: Additional Comments on Clarifications

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 14 Nov 2002 16:15:45 -0600

In adition to comments made by others I have these:

Section 5.10
  
  Tag number 10 is listed as reserved (4-10) and as the tag for AS_REQ

  Tag numbers 16 and 17 under comments are not listed as PDU or non-PDU
  I would think they need to be one or the other. 

Section 7.5.1  Key useage numbers:

  Number 15 is in section 5.6.1, not 5.3.1

  Number 16 and 17 are not listed or not listed as reserved. They should be reserverd.
 
  Number 19 is in section 5.2.6.4, not appendix B.4

Section 7.5.9

  Error codes 67, 68 and 69 should have some txt, not just (user-to-user) 

  Error codes listed as (pkinit) should say reserved for pkinit, or future use,
  as the pkinit is still in draft. 

Section 10 

 Last paragraph, there is an extra "the":  ...if the any...  

Section 11.1 References

 [KNT92] 
  I hope the text of Cliff's article, gets published soon, Its be around 
  since for over 10 years now.

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Fri, 15 Nov 2002 08:48:03 -0500

>>>>> "Douglas" == Douglas E Engert <[email-masked]> writes:

    Douglas>   Error codes 67, 68 and 69 should have some txt, not
    Douglas> just (user-to-user)

While I certainly don't mind having text for these error codes, I
don't want the Kerberos spec to imply clients or servers should
implement the behavior suggested by the u2u spec of using error codes
to mean that u2u should be used.  I have generally maintained the
assertion that negotiation at the application layer should be used to
determine whether u2u should be used rather than KDC policy.  If other
people disagree then we can continue to have that discussion, but it
should not happen with the base Kerberos spec.

---

From: "Douglas E. Engert" <[email-masked]>
Date: Fri, 15 Nov 2002 09:31:52 -0600

> should not happen with the base Kerberos spec.

You may be right, but the document is inconsistent at the moment.
Error codes 62-76 appear to be reserved for pkinit and user-to-user. 
So it should indicate reserved at least. 
 
User to user has been added to Clarifications in Section 3.7 User to User 
Authentiction Exchanges. We also have a text for error code 27, 
KDC_ERR_MUST_USE_UER2USER. So we could have the text for the 67, 68, 69
as these relate to using user to user. 

I did find in draft-swift-win2k-krb-user2user-03.txt  error code 67
and 69, but not 68. So it might be that Micrsoft already has these in 
thier code base. So these appear to be reservd for user-to-user with GSSAPI.  
But any appliction using user to user could use these error codes. 

--