[Ietf-krb-wg] FAST draft 11 submitted

Here are the major changes.
I believe most of these have received discussion on the list.

      The checksum member of the KrbFastFinished sequence has been
      removed.  A nonce field has been added to KrbFastResponse.
      The cookie no longer needs to be outside of FAST.  In fact, some
      security guarantees depend on the cookie being inside FAST now
      that the finish checksum has been removed.  Affected that change.
      Replace the rep-key field in KrbFastResponse with the strengthen-
      key field.  Per mailing list discussion, there are security
      advantages to strengthening the reply key.
      Clarify handling of authentication sets.
      Include the AD-fx-fast-used authorization data type.

In addition, I included appendix A, which contains test vectors for krb-fx-cf2.

Larry has not seen the note about random nonces or the test vector
appendix.  I suspect he'll agree with the content although probably
want to improve the formatting.

I believe that draft 11 is technically complete.  I expect to ask Jeff
for a working group last call as soon as Larry has reviewed.  I'd
definitely appreciate review of the changes in 11 to confirm that they
reflect consensus we've already achieved.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg