Subject: Re: [Ietf-krb-wg] FAST: ticket to use for fast TGS (responses desired)

From: Nicolas Williams <[email-masked]>
Date: Sun, 1 Feb 2009 12:26:46 -0600

On Fri, Jan 30, 2009 at 03:01:19PM -0500, Jeffrey Hutzelman wrote:
> Thus, I believe we definitely _should_ permit an explicit armor ticket to 
> be specified for a TGS exchange when the ticket being presented to the TGS 
> is not a TGT.  I think it is fine to require in this case that the explicit 
> armor ticket be a TGT.  This can be obtained by the client in any of the 
> usual ways that would be used for an AS request (host TGT, anonymous 
> PKINIT, anonymous-anonymous PKINIT), or using an existing TGT the client 
> has, or in any other way the client finds useful.
> 
> I'm undecided on the question of whether clients should be required to do 
> this, rather than simply using the ticket being presented to the TGS even 
> when that is not a TGT.  I guess I'm inclined not to require it, since
> 
> - clients are not required to use FAST
> - this is already an issue when not using FAST
> - even without this requirement, using FAST is an improvement

I agree that clients should not be required to use armor for TGS
exchanges, but they should be encouraged to do so.  TGSes should be
required to support use of armor in TGS exchanges.  If it's easier to
implement then it may well be the case that all clients will use armor
for TGS exchanges.

Nico
-- 
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg