Re: CIFS and the krb5 PRF

[Jeffrey Altman <jaltman at columbia.edu>]

The raw session key has very different properties than the output of
GSS_Pseudo_random().   We all agree that there is a need for
implementations of the krb5 mechanism to be able to expose the raw
components of the ticket.  The components that applications need access
to are no limited to the session key.  That is the reason the MIT
implementation is going to provide a implementation specific extension
to access all of the components of the ticket associated with the GSS
Context.   Let's not try to mix apples and oranges.

As for RFC 2712 (Kerberos Ciphers for TLS), this protocol does not use
GSS.  It would therefore provide no benefit to add this functionality.
What we do need to do is scrap RFC 2712 and replace it with something
either based on GSS or at least something that makes use of the KCrypto
PRF.  That discussion is not within the bounds of the Kitten charter.

Jeffrey Altman


Liqiang(Larry) Zhu wrote:

> What about adding a flag argument to GSS_Pseudo_random(), thus we can
> allow implementations to *optionally* expose the raw session key via the
> PRF. I am saying so assuming folks genuinely need to support a way to
> interop with existing applications that expose the direct Kerberos key
> today, Kerb-TLS, to think of it, is one of them.
> 
> -- Larry

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature

_______________________________________________
Kitten mailing list
Kitten at lists.ietf.org
https://www1.ietf.org/mailman/listinfo/kitten