Subject: Re: extra tgt draft

From: "Douglas E. Engert" <[email-masked]>
Date: Thu, 05 Dec 2002 16:28:53 -0600

Cliff, see comments about PA-EXTRA-TGT

Jonathan Trostle wrote:
> 
> Hi Doug,
> 
> I've been meaning to resubmit an update to the extra tgt draft for a while.
> I finally got around to it and it is enclosed below. This draft is similar
> to DCE RFC 26.0 (which it cites). One difference is that the client must
> generate a random key in DCE RFC 26.0, but not in the extra tgt draft.
> Jeff Schiller previously mentioned that he doesn't like see security
> protocols depend on clients to generate strong random keys. If you don't
> have any objections, I will most likely submit this in the next few days.
> 
> Jonathan

Clarifictions still comes first. You should look at referencing Clarifications 
and KCRYPTO rather then 1510.  

Since there is talk on the WG list about using DCE RFC26.0, this draft
might be the place to start, especially if DCE RFC26.0 has any problems with
Clarifications.  If the WG feels we need to move on this as a 
solution to the pre-auth problems, I would like to get others involved with
the draft too. 

One Problem I see is the way you combine keys (XOR'ed). This may not be possible
with some yet to be designed crypto system. Or if the two keys are not compatable,
 AES and DES for example. It should use KCRYPTO  functions to double encrypt 
or combine keys. There should be no assumptions about the similiarity of the keys.
It should define Key derivations if needed as well.

Also get to Cliff  *ASAP*  any enumerations you might need like the 
PA-EXTRA-TGT to make sure it is reserved in Clarifications. (But 
Clairifications will not be held up by this.)

-- 

 Douglas E. Engert  <[email-masked]>
 Argonne National Laboratory
 9700 South Cass Avenue
 Argonne, Illinois  60439 
 (630) 252-5444

---

From: Sam Hartman <[email-masked]>
Date: Thu, 05 Dec 2002 17:31:55 -0500

Also, please update your draft to be consistent with the crypto draft.