Subject: [Ietf-krb-wg] FAST draft 11 submitted

From: Sam Hartman <[email-masked]>
Date: Wed, 20 May 2009 15:19:32 -0400

Here are the major changes.
I believe most of these have received discussion on the list.

      The checksum member of the KrbFastFinished sequence has been
      removed.  A nonce field has been added to KrbFastResponse.
      The cookie no longer needs to be outside of FAST.  In fact, some
      security guarantees depend on the cookie being inside FAST now
      that the finish checksum has been removed.  Affected that change.
      Replace the rep-key field in KrbFastResponse with the strengthen-
      key field.  Per mailing list discussion, there are security
      advantages to strengthening the reply key.
      Clarify handling of authentication sets.
      Include the AD-fx-fast-used authorization data type.

In addition, I included appendix A, which contains test vectors for krb-fx-cf2.

Larry has not seen the note about random nonces or the test vector
appendix.  I suspect he'll agree with the content although probably
want to improve the formatting.

I believe that draft 11 is technically complete.  I expect to ask Jeff
for a working group last call as soon as Larry has reviewed.  I'd
definitely appreciate review of the changes in 11 to confirm that they
reflect consensus we've already achieved.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 20 May 2009 12:24:28 -0700

I have not seen any feedback on the comment i sent.

The do you publish/verified all versions of the test vectors (output  
enctype != enctype1) ?

Love

---

From: Sam Hartman <[email-masked]>
Date: Wed, 20 May 2009 15:51:30 -0400

>>>>> "Love" == Love Hörnquist Åstrand <[email-masked]> writes:
8
    Love> I have not seen any feedback on the comment i sent.  The do
    Love> you publish/verified all versions of the test vectors
    Love> (output enctype != enctype1) ?
Hmm.  I have not seen any comment from you other than test vectors
with enctype_out != enctype_1.  I responded to that message saying
that my implementation didn't support that at present, so I couldn't
verify.

I don't particularly think mixed-enctype test vectors are important
but if you want to propose specific text including such test vectors,
I'd be happy to include it.
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Wed, 20 May 2009 15:04:00 -0700

20 maj 2009 kl. 12:51 skrev Sam Hartman:

> Hmm.  I have not seen any comment from you

https://lists.anl.gov/pipermail/ietf-krb-wg/2009-April/007614.html

> other than test vectors

any other implementation that can verify ?

> I'd be happy to include it.

You have the test vectors already.

Love