Subject: [Ietf-krb-wg] Protected negotiation only for AS or for both AS and TGS

From: Sam Hartman <[email-masked]>
Date: Fri, 04 Feb 2011 15:08:42 -0500

In https://lists.anl.gov/pipermail/ietf-krb-wg/2009-April/007593.html
Larry proposed a negotiation method.  It's my understanding we have a
consensus to adopt this method.
In Larry's original message things seem to be scoped to the AS case.

I implemented this for MIT Kerberos.  When I implemented I added KDC
support for both AS and TGS, but client support for AS only.

Thinking more about this, I actually think there is value in supporting
this for both AS and TGS.  I think that KDCs MUST return
PA-REQ-ENC-PA-REP for both types of requests (even though the key usage
assignment includes AS_REQ in its name) but clients are only required to
send PA-REQ-ENC-PA-REP for the AS case.

Do people agree with this?
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg