Re: [kitten] WGLC on draft-ietf-krb-wg-cammac-08

[Tom Yu <[e-mail]>]

"Zheng, Kai" <[e-mail]> writes:

> Regarding the following:
> ===
> However, protocol extensions such as Constrained Delegation (S4U2Proxy
>    [MS-SFU]) require that a service present to the KDC a service ticket
>    that the service received from a client, as evidence that the client
>    authenticated to the service.  In the S4U2Proxy extension, the KDC
>    uses the evidence ticket as the basis for issuing a derivative ticket
>    that the service can then use to impersonate the client.
> ===

[...]

> This forwardable service ticket might have been obtained by a
> KRB_AP_REQ and come from the user client (the case mentioned here), or
> by an S4U2self request (ignored here).

Hi Kai,

Thanks for your comment.  I can see how apparently ignoring tickets
obtained from S4U2Self could be distracting or confusing to a reader.
Would the following text be better?

   However, protocol extensions such as Constrained Delegation
   (S4U2Proxy [MS-SFU]) require that a service present to the KDC a
   service ticket that the KDC previously issued, as evidence that the
   service is authorized to impersonate the client principal named in
   that ticket.  In the S4U2Proxy extension, the KDC uses the evidence
   ticket as the basis for issuing a derivative ticket that the service
   can then use to impersonate the client.