Subject: [Ietf-krb-wg] DHCPv6 transport service option

From: Simon Josefsson <[email-masked]>
Date: Fri, 31 Jul 2009 16:27:38 +0200

Sakane-San,

At the mic today I asked you that a number for TLS should be allocated
in this table:

   o  Service Type: the value of the type is defined in below.

      Reserved 0
      UDP      1 (default)
      TCP      2
      SCTP     3
      HTTP     4
      Reserved 5-15

Leif pointed out that krb5starttls is run over TCP, so a type value for
TLS is not really needed.  (I believe this was Leif's entire comment,
correct me if I'm wrong.)  I didn't know how to respond.

Having had a chance to think more about this, I see some value in having
a number reserved for TLS: it allows clients to avoid having to spend
one round-trip to find out the KDC does not support starttls.  That is a
minor optimization, but since I also do not see any harm in having a
value allocated, I think it makes sense to add it.

If a TLS service type is present, the client saves one round-trip.  If
the TLS service type is not present, and only the TCP type is present,
the client cannot infer anything and could attempt to negotiate TLS.

The high-level issue is of course whether the Service Type is useful at
all.  I'm positive about it and would prefer to mirror the DNS SRV
packet exactly and defer to RFC 4120 and RFC 2052 for the semantics.

/Simon
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg