Subject: Is krb_cred for GSSAPI encrypted in subkey or not

From: [email-masked] (Sam Hartman)
Date: Mon, 6 Jan 2003 16:21:21 -0500 (EST)

If my GSSAPI implementation is using RC4, AES or some other enctype
for which it wants to encrypt the krb_cred message in the
authenticator for delegated credentials, should it encrypt the
krb_cred in the session key or subsession key?

Our implementation will accept either unencrypted krb_cred, krb_cred
encrypted in the subsession key or krb_cred encrypted in the session
key.  

However I'm not sure what to generate.  Currently (and in future for
des and 3des) we generate unencrypted krb_cred messages.  We intend to
generate encrypted krb_cred for rc4 and aes.

Thanks,

--Sam