Re: [SPKM] Re: FW: I-D ACTION:draft-zhu-pku2u-01.txt

Nicolas Williams wrote:
> 
> On Wed, Apr 18, 2007 at 10:46:41PM +0200, Martin Rex wrote:
> > Liqiang wrote:
> > > 
> > > Olga Kornievskaia wrote:
> > > > First, I hope that the 1st sentence refers to "tokens" not just the 
> > > > 1st (AS_REQ) token. As its written, it says that AS_REQ token is framed 
> > > > but the AS_REP token is not which doesn't make sense.
> > > 
> > > Your understanding is correct. Only the first message has the framing.
> > > This is consistent with RFC4121 and RFC4178.
> > 
> > NOPE, it is significantly different from rfc1964 and rfc4121.
> 
> Regardless, RFC2743 only requires it on the initial context token.

I know.  I did confirm this a few lines later.

> 
> We should probably consider whether we want to RECOMMEND, or even
> REQUIRE that that header be added to all security context establishment
> tokens, not just the initial one.
> 
> But until somebody tables that matter we should not consider
> RFC1964/4121 as imposing such a requirement on other mechanism that use
> different mechanism OIDs.

Require, because it will amount to less code, less complexity and less
confusion.  The overhead is negligable.  I don't expect any implementation
of PKU2U to NOT provide rfc1964/rfc4121 functionality as well, despite
the seperate mechanism OID.

> 
> That said, there's this interesting question: PKU2U re-uses RFC4121 for
> everything following PKU2U's first two security context tokens (which
> are KDC messages between the initiator and the acceptor acting as a
> pseudo-KDC), so, should those context tokens lifted from RFC4121 bear
> this header?

I really want to see the generic framing on all context level tokens
(which is what you meant by header, I assume).

Could it be that you actually didn't want to ask about the framing,
but about the mechanism OID within the header (if it is present)?

I'd like to see the generic framing, and I'd like to see it with
the same mechanism OID as in the initial context token (which is
different from rfc1964/rfc2141).

-Martin

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm