Subject: ASN.1 typo?

From: Simon Josefsson <[email-masked]>
Date: Tue, 05 Aug 2003 20:29:39 +0200

Shouldn't KDC-REQ-BODY.enc-authorization-data be marked as OPTIONAL?
It was in 1510.  The text in the draft implies enc-authorization-data
should not be present in AS-REQ, which is difficult to achieve if the
ASN.1 module require it to be present.

(For what it's worth, with this modification, I am able to use the new
ASN.1 module instead of the old 1510 derived module I used before.)

KDC-REQ-BODY    ::= SEQUENCE {
           kdc-options             [0] KDCOptions,
           cname                   [1] PrincipalName OPTIONAL
                                       -- Used only in AS-REQ --,
           realm                   [2] Realm
                                       -- Server's realm
                                       -- Also client's in AS-REQ --,
           sname                   [3] PrincipalName OPTIONAL,
           from                    [4] KerberosTime OPTIONAL,
           till                    [5] KerberosTime,
           rtime                   [6] KerberosTime OPTIONAL,
           nonce                   [7] UInt32,
           etype                   [8] SEQUENCE OF Int32 -- EncryptionType
                                       -- in preference order --,
           addresses               [9] HostAddresses OPTIONAL,
           enc-authorization-data  [10] EncryptedData -- AuthorizationData --,
           additional-tickets      [11] SEQUENCE OF Ticket OPTIONAL
                                           -- NOTE: not empty
   }

Thanks.

---

From: Tom Yu <[email-masked]>
Date: Tue, 05 Aug 2003 16:01:35 -0400

>>>>> "jas" == Simon Josefsson <[email-masked]> writes:

jas> Shouldn't KDC-REQ-BODY.enc-authorization-data be marked as
jas> OPTIONAL?  It was in 1510.  The text in the draft implies
jas> enc-authorization-data should not be present in AS-REQ, which is
jas> difficult to achieve if the ASN.1 module require it to be
jas> present.

Hm.  Oops, that would in fact be a mistake in the ASN.1.
KDC-REQ-BODY.enc-authorization-data should be marked OPTIONAL.  I'm
not quite sure how that omission happened.

---Tom

---

From: Ken Raeburn <[email-masked]>
Date: Tue, 05 Aug 2003 18:01:31 -0400

> not quite sure how that omission happened.

Okay, so, procedurally, how do we fix it, now that we've passed the
document on to the IESG?

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 5 Aug 2003 15:02:35 -0700

> Okay, so, procedurally, how do we fix it, now that we've passed the

Similar thinkos occurred in the NFSv4 I-D which were fixed in the
author's 48 hour period.  I think the same should be done here.

Cheers,

Nico
--

---

From: Sam Hartman <[email-masked]>
Date: Tue, 05 Aug 2003 18:28:52 -0400

>>>>> "Nicolas" == Nicolas Williams <[email-masked]> writes:

    Nicolas> On Tue, Aug 05, 2003 at 06:01:31PM -0400, Ken Raeburn
    Nicolas> wrote:
    >> Tom Yu <[email-masked]> writes: > Hm.  Oops, that would in fact
    >> be a mistake in the ASN.1.  >
    >> KDC-REQ-BODY.enc-authorization-data should be marked OPTIONAL.
    >> I'm > not quite sure how that omission happened.
    >> 
    >> Okay, so, procedurally, how do we fix it, now that we've passed
    >> the document on to the IESG?

    Nicolas> Similar thinkos occurred in the NFSv4 I-D which were
    Nicolas> fixed in the author's 48 hour period.  I think the same
    Nicolas> should be done here.

No, it's a technical change; it could happen in 48-hour review, but
the IESG would have to be notified and agree.

Note IETF last call has not happened yet.  Just bring it up then, get
approval and then actually make the change in the 48-hour period,
assuming that nothing forces you to have a new draft before that.

---

From: Nicolas Williams <[email-masked]>
Date: Tue, 5 Aug 2003 15:30:12 -0700

> the IESG would have to be notified and agree.

Granted.  But I think the same consideration should, and, I hope, will
be given to this error as was given to the NFSv4 errors as the two are
in the same league.