Subject: Comments on draft-ietf-krb-wg-kerberos-clarifications-03 section 2

From: [email-masked] (Sam Hartman)
Date: Thu, 3 Apr 2003 11:40:54 -0500 (EST)

The following text is not grammatical:

 Some implementations of RFC 1510 are known
    to reject unknown KDC options, so clients may need to resend a
    request without KDC new options absent if the request was rejected
    when sent with option added since RFC 1510. 

Replace KDC new options absent with new KDC options.  Replace option
added with options added.

In section 2.8, I do not understand the meaning of the dangling
phrase:

    encrypted part of the KDC reply indicates to the client that the
    server (not the client) specified in the ticket has been determined
    by policy of the realm to be a suitable recipient of delegation.  A
    client can use the presence of this flag to help it make a decision
    whether to delegate credentials (either grant a proxy or a forwarded
    ticket-granting ticket) to this server.  Ignore the value of this
    flag. When setting this flag, an administrator should consider the
    Security and placement of the server on which the service will run,
    as well as whether the service requires the use of delegated
    credentials.