Re: [kitten] CAMMAC open issues

[Greg Hudson <[e-mail]>]

On 11/12/2013 01:05 AM, Jeffrey Hutzelman wrote:
> We're designing a generic container that allows the KDC to send
> authenticated authorization data.  It seems to me that limiting that
> container to supporting only non-critical authorization data is both
> short-sighted and unnecessary.

In reality, we cannot create critical authdata because some (all?)
implementations ignore unrecognized authdata in violation of RFC 4120,
so the concept of critical authdata more of a standards-process nuisance
than anything else.

We could treat CAMMAC as an opportunity to change this, but it's only a
weak opportunity.  We could trust that implementors of CAMMAC will treat
CAMMAC-wrapped authdata as critical if the CAMMAC is not itself wrapped
in an AD-IF-RELEVANT.  But unless (1) everyone implements CAMMAC, and
(2) enough time has passed that everyone has upgraded to versions
implementing CAMMAC, some implementations would still ignore
CAMMAC-wrapped supposedly-critical authdata elements.