Subject: Re: [kitten] [Ietf-krb-wg] Channel bindings -- interop issue with GSS_C_AF_*
From: Nico Williams <[email-masked]>
To: Sam Hartman <[email-masked]>
Cc: [email-masked], Simon Josefsson <[email-masked]>, "[email-masked]" <[email-masked]>
Date: Wed, 8 Jun 2011 12:05:28 -0500
List-Id: Common Authentication Technologies - Next Generation <kitten.ietf.org>

On Wed, Jun 8, 2011 at 11:57 AM, Sam Hartman <[email-masked]> wrote:
> I think RFC 2744 chose the wrong constant for nulladdr; it should have
> been 0 not 255.  I think we need to update RFC 2744 and 5554.
> I believe that

I'm agnostic as to that.  I don't mind saying "must use
GSS_C_AF_UNSPEC and null addresses" and leaving RFC2744 alone.

> 1) Mechanism implementations should collapse unspecified address with no
> actual data and null address together
>
> 2) The Kerberos mechanism should do so in a manner compatible with
> Microsoft

Agreed, though (2) subsumes (1).

> 3) We need to explicitly specify what applications should do here.
>
> If someone argues that we cannot make incompatible changes to 2744, I
> respond that compatibility with the implementations we know about is
> more important to me than compatibility with the spec and if forced to
> choose I will choose the implementations.

+1

Nico
--