Subject: Re: [Ietf-krb-wg] otp-challenge SIZE(8..MAX) in draft-ietf-krb-wg-otp-preauth-15.txt

From: <[email-masked]>
Date: Tue, 1 Mar 2011 13:10:48 -0500

> >
> > How about compromise:
> >
> >          The challenge is an optional
> >          octet string that SHOULD be uniquely generated for 
> each request
> >          in which it is present.  The challenge and SHOULD 
> be at least
> >          eight octets unless challenges of that length are 
> not supported
> >          by the token.
> 
> I'm not crazy about recommending any specific minimum length. 
>  It also doesn't seem to add any value to the spec.
> 
> But it's fine if that's the way you want to go.  No more 
> arguments here.
> 

As I mentioned in an earlier reply, the 8 character recommendation came from an EAP document [RFC4793] and I believe that that was in order to try and ensure that there is a reasonable amount of entropy in the final OTP value.  However, since this is a framework to support different OTP methods, some of which may be challenge only and others may combine challenges with time etc, then I agree that this is probably not the place to impose these types of constraints.  It should really be a requirement on a particular OTP method. 

I will remove the sentence from the paragraph:

                  The otp-challenge is used by the KDC to send a
                  challenge value for use in the OTP calculation.  The
                  challenge is an optional octet string that SHOULD be
                  uniquely generated for each request in which it is
                  present.  

--Gareth 
_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg