Subject: [Ietf-krb-wg] preauth-framework-10 comments

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 29 Apr 2009 15:15:18 -0700

KDC-REQ-BODY should be optional in AS-REQ, "Typically, a client will  
know that
FAST is being used before a request containing PA-FX-FAST is sent.",
there is no need to provide backward compatibility with the KDC.

Consider a client that want to us RFC4556, but also for privacy reason
want to not expose the outer KDC-REQ-BODY, by sending a privacy
version of the request (dummy values), RFC4556 will sign the outer non
unique message and there will be no real binding between the REQ-BODY
and padata.

My conclusion is that rfc4556 is incompatible with FAST is outer and
inner KDC-REQ-BODY is different.

Lets make KDC-REQ-BODY OPTIONAL.

So RFC4556 needs to be updated as FAST factor ?

Love

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg