Subject: [Ietf-krb-wg] review of draft-zhu-pku2u-03

From: Leif Johansson <[email-masked]>
Date: Sun, 09 Dec 2007 00:54:32 +0100

Hello Larry and Jeffrey,

I have reviewed this draft. These are my comments that have nothing
to do with the naming-issues discussed elsewhere.

First of all I think the normative language in the draft SHOULD be
rephrased to be normative using the language of 2119 throughout.

The only major problem I have with the draft is that it claims to
provide a mechanism for user-to-user communication which does
not require a trusted third party. This is only true in the sense
that a KDC isn't required. The draft either requires a CA to issue
certificates or an entity which in some other way guarantees
name-key-binding. That entity by definition constitutes a trusted
third party. I suggest changing the introduction to something like:

"This mechanism provides security services in peer to peer
networking environments without requiring a Key Distribution
Center (KDC) and can act as a bridge between PKI and GSS-API
for such environments."

Finally a minor nit in the last paragraph of section 6:

"The gss-mic field in the KRB-FINISHED structure contains a checksum
of all the GSS-API tokens exchanged between the initiator and the
acceptor, and prior to the GSS-API token containing the AP-REQ
[RFC4120].  This checksum is performed over these GSS-API tokens in
the order that the tokens were sent."

This language is difficult to read to me. First there seems to be an
extra "and" in "and prior to" (both in the ASN. comment and in the
text). I'm not sure If I understand this but is this what you mean?

"The gss-mic field contains a checksum of all the GSS-API tokens sent
from the initiator to the acceptor in the order they were sent, prior
to the current token."

    Cheers Leif
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg