Re: [kitten] Comments on draft-ietf-kitten-iakerb-01

[Greg Hudson <[e-mail]>]

On 02/16/2014 12:14 PM, Greg Hudson wrote:
> This doesn't provide useful advice for interoperating with an MIT
> initiator, as a standard acceptor will always frame the response token.
> I suggest:
> 
>   Acceptors behave as follows:
> 
>   o  If the AP-REQ authenticator contains an extension of type 1
>      containing a KRB-FINISHED message, then process the extension as if
>      it were of type GSS_EXTS_FINISHED, except with a key usage of
>      KEY_USAGE_IAKERB_FINISHED (42) instead of KEY_USAGE_FINISHED (41).

I missed a necessary bullet point here.  Before the AP-REQ bullet point,
I suggest:

  o  After the first initiator token, allow initiator tokens to omit
generic token framing.  This allowance is required only for IAKERB_PROXY
messages (those using token ID 05 01), not for tokens defined in [RFC4121].

It might also be worthwhile to say that, for the purpose of computing
the KRB-FINISHED checksum, initiators and acceptors should both use the
tokens they sent or received without modification--that is, don't insert
synthetic generic token framing or modify the token to have the
standardized extension type.  But I don't have suggested wording, and it
should be fairly obvious even if we don't say it.