Re: Comments on draft-ietf-kitten-krb5-gssapi-prf-03.txt

Nicolas Williams wrote:
> 
> On Tue, May 24, 2005 at 12:43:37AM +0200, Martin Rex wrote:
> > As with a similar discussion on krb-ietf list how a KDC cert should
> > be verified in PKINIT, we should not ignore the fact that the affected
> > spec (here) is going to be normative for both, the gssapi mechanism
> > implementor and the application gssapi caller, and those two
> > will have an entirely different background and needs.
> > 
> > We should add a reference to the document draft-eastlake-randomness2-10.txt
> > that is sitting on the Editor's queue:
> 
> With respect to what?  The input to the PRF?

You got me, I'm not following my own advice.

This reference should be guidance for gssapi mechanism implementors
that provide PRF output based on the cryptographic session key.

It may not be necessary for gssapi mechanisms where the implementation
details are public or even part of a public/published spec.
But you should not underestimate the number of gssapi mechanisms
that don't have a formal spec of any kind, there are plenty of
them.

GSS-API is primarily a spec for an API and only secondarily a
framework for independent interoperable mechanism implementations
based on common public spec.  And in order to provide a useful
standard for the application writers, the spec will have to provide
some guidance on behaviour for proprietary gssapi mechanisms and
a level of expectation for the application writers.

-Martin

_______________________________________________
Kitten mailing list
Kitten@lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten