Subject: [Ietf-krb-wg] preauth framework: which authentication set to use

From: Sam Hartman <[email-masked]>
Date: Tue, 08 Jul 2008 12:04:02 -0400

Folks, at the last couple of IETFs' we've been discussing how the
client should tell the KDC which authentication set it is choosing to
use.

I think we had settled on the client sending an integer to specify
what member of the sequence it chose.

I seem to also recall that there was great ambivilence on whether to do that or whether to send the PA-AUTHENTICATION-SET-ELEM.

I think I've found a reason to prefer the other approach: we should
send the PA-AUTHENTICATION-SET-ELEM.  If a client is attempting to
cache pre-authentication sets or to send an authentication set based
on optimistic information, then the integer won't work well.  Even if
the authentication set that the client has chosen has not changed, if
the KDC had moved around authentication set items or added a new
authentication set, then things will get very confused.  Also, the
integer provides less opportunity for error checking.

So, absent objections I'm going to specify the approach where we send the authentication set element.

--Sam

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg