[kitten] Proposal to change requirements for anonymous TGS requests

[Greg Hudson <[e-mail]>]

Since I believe we plan to re-issue RFC 6112 to address the KeyExchange
vs. KEYEXCHANGE error, I would like to bring up another issue which I
noticed today.  Section 4.2 says:

   If the ticket in the PA-TGS-REQ of the TGS request is an anonymous
   one, the anonymous KDC option MUST be set in the request.  Otherwise,
   the KDC MUST return a KRB-ERROR message with the code
   KDC_ERR_BADOPTION.

MIT krb5 does not comply with this requirement on the client side and
does not check it in the KDC.  We can change that on the client, but in
general this requirement seems totally unnecessary, and the KDC side of
it seems to be a clear violation of RFC 2119 section 6.  I propose
changing this text in the re-issued RFC to:

   If the ticket in the PA-TGS-REQ of the TGS request is an anonymous
   one, the anonymous KDC option SHOULD be set in the request.

So the first MUST becomes a SHOULD, and the second sentence goes away.
If people feel that there should be a rationale for the SHOULD, I would
suggest this text instead:

   If the ticket in the PA-TGS-REQ of the TGS request is an anonymous
   one, the anonymous KDC option SHOULD be set in the request, as a
   previous version of this specification required the KDC to reject the
   TGS request otherwise.