Re: [kitten] Updating IANA krb5 GSSAPI token type registry

[[e-mail] (Martin Rex)]

Tom Yu wrote:
> Benjamin Kaduk <[e-mail]> writes:
> 
> > On Tue, 6 Aug 2013, Benjamin Kaduk wrote:
> >
> >> Looking up the TOK_ID for IAKERB_PROXY (or rather, how assignments
> >> of such values are performed) reveals that the IANA registry for
> >> token types is
> >> incomplete(!). http://www.iana.org/assignments/kerberos-v-gss-api/kerberos-v-gss-api.xhtml#token-types
> >> lists only 0100, 0200, 0300, 0404, 0504, 0601, and 0602 as assigned,
> >> but 0101, 0201, and 0102 are documented in RFC1964.

Glancing over the archives, I see the following TOK_IDs in
Kerberos-specific specifications:


  rfc1964 defines
http://tools.ietf.org/html/rfc1964#page-2
     0100  KRB_AP_REQ                       (page  2)
     0200  KRB_AP_REP                       (page  2)
     0300  KRB_ERROR                        (page  2)

     0101  gss_get_mic() token              (page  7)
     0201  gss_wrap() token                 (page 10)
     0102  gss_delete_sec_context() token   (page 12)

  rfc4121 adds
http://tools.ietf.org/html/rfc4121#section-4.2.6.1
     0404  gss_get_mic() token without generic framing
     0504  gss_wrap() token without generic framing

> and the allocation procedure for TOK_ID values is expert review.  I'm
> also noticing that the RFC 4121 reserved values for 6000 through 60ff
> (see section 4.4) are not marked as reserved in the registry for some
> reason.

     6000-60ff reserved to determine if generic GSS-API framing is present
               on per-message tokens just by looking at the first two bytes
               of the token


http://tools.ietf.org/html/draft-swift-win2k-krb-user2user-03
   0400   KERB-TGT-REQUEST
   0401   KERB-TGT-REPLY

http://tools.ietf.org/html/draft-ietf-krb-wg-iakerb-02
   0501   IAKERB_PROXY



plus something "else":

http://tools.ietf.org/html/draft-ietf-abfab-gss-eap-08#page-17

   0601   Initiator->Acceptor Token
   0602   Acceptor->Initiator Token


-Martin