Subject: Re: Unclear behavior for krb_cred message especially with regard to GSSAPI

From: Love <[email-masked]>
Date: Mon, 03 Mar 2003 15:37:55 +0100

Sam Hartman <[email-masked]> writes:

> If we
> are going to do something different for RFC 1964 we should have a very
> strong reason.

As I understand it, requiring a nonce (and timestamp) in the krb-cred to be
sent will break interopbility with existing gssapi-krb5 clients and servers.

Love

---

From: Sam Hartman <[email-masked]>
Date: Sat, 08 Mar 2003 15:29:15 -0500

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> Sam Hartman <[email-masked]> writes:
    >> If we are going to do something different for RFC 1964 we
    >> should have a very strong reason.

    Love> As I understand it, requiring a nonce (and timestamp) in the
    Love> krb-cred to be sent will break interopbility with existing
    Love> gssapi-krb5 clients and servers.

Yes.  I agree that we should neither require nor expect a nonce.  I
disagree that we should mandate must-not-validate if the nonce is in
fact sent.