Re: [SPKM] RE: Comments on draft-zhu-pku2u-01.txt

>>>>> "Jeffrey" == Jeffrey Hutzelman <jhutz@cmu.edu> writes:

    Jeffrey> On Sun, 18 Mar 2007, Liqiang(Larry) Zhu wrote:
    >> Jeffrey Hutzelman wrote: > Why?  How does the initiator handle
    >> these tokens?  If it does so in any > way other than by
    >> producing a new token, then the acceptor should not be >
    >> returning GSS_S_CONTINUE_NEEDED.
    >> 
    >> The deployment experience shows that if the client (instead of
    >> the acceptor or the KDC) can log the error information, the
    >> cost of trouble shooting is significantly lower.
    >> 
    >> If the acceptor returns a KRB_ERROR message with a status that
    >> is anything but GSS_S_CONTINUE_NEEDED, there is no guarantee
    >> and it is in fact very unlikely that the trouble-shooting
    >> information can make it to the client side in order to get
    >> logged.

    Jeffrey> No; you are confused.  GSS_S_CONTINUE_NEEDED does not
    Jeffrey> mean "there is a token to send to the peer".  It means
    Jeffrey> "another token is expected from the peer".  Any token
    Jeffrey> produced by GSS_Accept_sec_context should be sent to the
    Jeffrey> peer regardless of the returned status code.

    Jeffrey> Behaving otherwise violates the abstraction and will
    Jeffrey> break application protocols which expect the GSS-API to
    Jeffrey> behave as specified, regardless of which mechanism is
    Jeffrey> being used.

I strongly agree with Jeff here.

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm