Subject: [Ietf-krb-wg] Review draft-ietf-krb-wg-anon-04.txt

From: Love Hörnquist Åstrand <[email-masked]>
Date: Thu, 6 Dec 2007 18:48:42 -0800

I read over the document today and found these issues:

Split the AS and TGS descriptions in diffrent sub sections for  
readablity and overview.

The text is in the "TGS section" (quoted below), I assume this apply  
to the AS section.
Its kind of strange to define how older code that exists before this  
draft is
supposed to work.

    "If the client is anonymous and the KDC does not have a key to  
encrypt
    the reply (this can happen when, for example, the KDC does not
    support PKINIT [RFC4556]), the KDC MUST return an error message with
    the code KDC_ERR_NULL_KEY [RFC4120] and there is no accompanying
    e-data defined in this document."

Edata for TGS error case, I think it should be allowed. If not it  
should be motivated why not (extentiblity ?).

Love

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg