Re: [kitten] Kerberos preauth negotiation techniques

[Nico Williams <[e-mail]>]

On Tue, Feb 17, 2015 at 11:14:35AM -0500, Nathaniel McCallum wrote:
> I see 1 and 3 as the only good options. Having to register group 
> parameters instead of using OIDs is a deal-breaker in my book.

I also prefer not to have to add registration of groups.  I'm not sure
that I want to have any support for negotiable group parameters though,
if that's what you meant.  I'd rather have well-known curves (groups)
suitable for discrete codepoint assignments regardless of whether we
have/need a registry.

However, a single popular use case for negotiable groups will make (2)
utterly inapplicable, and that's the best case for not considering (2),
IMO.

On the whole I prefer (3).  I agree that it's an optimization that could
come later though.  But it's also an optimization that clients could
implement immediately (with the fallback penalty); it's only the AS
where more work is needed.

Nico
--