Re: [SPKM] Re: FW: I-D ACTION:draft-zhu-pku2u-01.txt

On Wed, Apr 18, 2007 at 10:46:41PM +0200, Martin Rex wrote:
> Liqiang wrote:
> > 
> > Olga Kornievskaia wrote:
> > > First, I hope that the 1st sentence refers to "tokens" not just the 
> > > 1st (AS_REQ) token. As its written, it says that AS_REQ token is framed 
> > > but the AS_REP token is not which doesn't make sense.
> > 
> > Your understanding is correct. Only the first message has the framing.
> > This is consistent with RFC4121 and RFC4178.
> 
> NOPE, it is significantly different from rfc1964 and rfc4121.

Regardless, RFC2743 only requires it on the initial context token.

We should probably consider whether we want to RECOMMEND, or even
REQUIRE that that header be added to all security context establishment
tokens, not just the initial one.

But until somebody tables that matter we should not consider
RFC1964/4121 as imposing such a requirement on other mechanism that use
different mechanism OIDs.

That said, there's this interesting question: PKU2U re-uses RFC4121 for
everything following PKU2U's first two security context tokens (which
are KDC messages between the initiator and the acceptor acting as a
pseudo-KDC), so, should those context tokens lifted from RFC4121 bear
this header?

I could go either way.

Nico
-- 

_______________________________________________
SPKM mailing list
SPKM@ietf.org
https://www1.ietf.org/mailman/listinfo/spkm