Subject: RFC4121 hash agility semantics?

From: Nicolas Williams <[email-masked]>
Date: Wed, 22 Mar 2006 16:51:23 -0600

Som to continue Monday's discussion, I have this observation and
associated question:

 - We probably can't change the number of round-trips the mechanism will
   use :)

So, how to negotiate whether to MD5 or something else?

Choices are:

 - figure out a way for the KDC to do it, just like it negotiates
   enctypes and RFC1964 vs RFC4121 now; it's too late to use session key
   enctype to make this negotiation, as we did for RFC1964 vs RFC4121

 - let the initiator choose (how?! flag? local config?) which it wants
   and suffer failure when it wants not-MD5 and talks to old acceptors 

 - let the initiator do both and hope the server knows how to not-MD5
   and oh well if it doesn't

Nico
--