Re: [kitten] I-D Action: draft-ietf-krb-wg-cammac-07.txt

[Tom Yu <[e-mail]>]

I think this is ready for Working Group Last Call if we strike out the
open questions.

The most significant technical change is to change kdc-verifier so that
it binds to the ticket.  There are significant editorial changes to the
motivation text, which hopefully reads more smoothly now.  Thanks to
Ben, Zhanna, and others who made suggestions.

Changed other-verifiers so that it encodes more compactly in the common
case where there are no Verifiers in other-verifiers.  I recall no
significant objections to this.  Made kvno and enctype optional in
Verifier-MAC.  I think there was consensus for this after people
realized that a checksum rather than ciphertext was involved.

One possible open question is whether to define some verifier that is
like the kdc-verifier but not bound to the ticket.  This would allow for
detached CAMMAC verification without needing a copy of the ticket.  I'm
inclined to defer this until there's a use case for it, because it can
probably be put in other-verifiers, and might not even require
additional specification.