Subject: Re: I-D ACTION:draft-ietf-cat-kerberos-pk-init-18.txt

From: Sam Hartman <[email-masked]>
Date: Mon, 08 Mar 2004 14:15:47 -0500

>>>>> "Love" == Love  <[email-masked]> writes:

    Love> - EncryptionKey, PrincipalName, Realm, KerberosTime,
    Love> Checksum, TypedData should be IMPORTed from krb5
    Love> kerberos-clarifications.

These are not PDUs.  I though we only wanted people importing PDUs
from Kerberos.

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Mon, 08 Mar 2004 17:27:49 -0500

> These are not PDUs.  I though we only wanted people importing PDUs

For applications _using_ Kerberos, perhaps.  Really, we don't want 
application protocols to directly use non-PDU types at all.  PKINIT, 
however, is an extension to Kerberos, and it is necessary and appropriate 
for it to use types which are internal to the Kerberos protocol.  Offhand, 
I think it's probably appropriate that these types be imported rather than 
copied.

_However_...  This decision really should be made with an eye toward what 
we want to happen when these types change in the underlying specification. 
What happens to PKINIT when PrincipalName and Realm change to allow UTF-8 
strings?  Does PKINIT automatically allow them?  Only in extensions-format 
messages?  Or does it continue to use the clarifications types, which admit 
only US-ASCII?

-- Jeff