Subject: RE: draft-zhu-kerb-enctype-nego-04 changes from 03

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 24 Oct 2005 15:28:25 -0700

You are correct that the server can always choose to ignore the
extension.

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Chaskiel M
Grundman
Sent: Monday, October 24, 2005 2:57 PM
To: [email-masked]
Subject: Re: draft-zhu-kerb-enctype-nego-04 changes from 03

--On Monday, October 24, 2005 17:06:10 -0400 Ken Raeburn
<[email-masked]> 
wrote:

> The session key enctype may be excluded from the enctype list at the
> client's choice; if it is excluded, this tells the server that it
MUST
> NOT use that enctype (or, in other words, if it sends a subkey,  and
it
> supports this extension, it must use a different enctype,  chosen from
> the list).  If the session key enctype is included, it  goes at the
end
> of the list.

Unless some future specification makes this extension mandatory, the
MUST 
seems silly. since there is no extension-specific data in the AP_REP,
the 
client cannot tell if the server supports the extension unless the
server 
changes the subkey type. (and so from a protocol point of view, there is
no 
difference between the server not supporting the extension and ignoring 
this MUST)

---

From: "Liqiang(Larry) Zhu" <[email-masked]>
Date: Mon, 24 Oct 2005 16:50:55 -0700

If the server understands this extension, then it MUST honor the
request. I think this way we can get more consistent behavior and the
key word MUST simplifies implementations. I would prefer the "MUST" over
the "SHOULD" here, and at the same time I acknowledge that it is not
enforceable.

-- Larry

-----Original Message-----
From: [email-masked]
[mailto:[email-masked]] On Behalf Of Ken Raeburn
Sent: Monday, October 24, 2005 4:21 PM
To: Chaskiel M Grundman
Cc: [email-masked]
Subject: Re: draft-zhu-kerb-enctype-nego-04 changes from 03

On Oct 24, 2005, at 17:57, Chaskiel M Grundman wrote:
> Unless some future specification makes this extension mandatory,  
> the MUST seems silly. since there is no extension-specific data in  
> the AP_REP, the client cannot tell if the server supports the  
> extension unless the server changes the subkey type. (and so from a  
> protocol point of view, there is no difference between the server  
> not supporting the extension and ignoring this MUST)

Right.  I mentioned this when talking with Larry.  I think the idea  
is, "this enctype from the KDC is too weak for exchanging lots of  
data, so if you don't come back with a different enctype, I'm just  
going to close the connection".  I'd prefer a SHOULD here, with an  
explanation of that case.

Ken