Subject: draft-zhu-kerb-enctype-nego: enctype negotiation

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Thu, 31 Mar 2005 09:49:44 -0800

At IETF 62, we agreed to add text to say that the server-asserted subkey
must win.

I proposed to change section 3 to have the following:

   If the EtypeList is present and the server prefers an enctype from
   the client's enctype list over that of the AP-REQ authenticator
   subkey (if that is present) or the service ticket session key, the
   server MUST create a subkey using that enctype.  This negotiated
   subkey is sent in the subkey field of AP-REP message and it MUST be
   used for subsequent communication.

   This negotiation extension MUST NOT be used when the client does not
   expect the subkey in the AP-REP message from the server.

-- Larry