[Ietf-krb-wg] FAST, errors and e-data

I want to bring up particularly tricky implementation issues I run
into while implementing FAST, so people can evaluate them when
evaluating the spec.

I'm working on refactoring the KDC code for MIT Kerberos to  support FAST.

FAST reinterprets how KRB-ERROR's e-data field is handled.
Previously, the e-data for most errors was unspecified.  Some errors,
especially those used by pkinit, used typed-data for error handling.
Some errors, especially including preauth_required used a sequence of
padata in the krb-error.

It's potentially possible that some error uses e-data in some
completely unknown way, but that's definitely not true for any of the
standardized errors.

I think what the FAST spec does makes a lot of sense, but it is tricky
to implement if you have an existing plugin interface for
pre-authentication.  At least in MIT Kerberos, the callback
responsible for verifying a padata item returns an e-data field
directly to be included in the FAST response.

Your fast implementation needs to somehow deal with that.

Long term, we want padata plugins to return a sequence of padata to go
in the error.  In the short term, we're probably going to end up
decoding the e-data coming out of the pre-auth plugin as either a
typed-data or a padata.
_______________________________________________
ietf-krb-wg mailing list
ietf-krb-wg@lists.anl.gov
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg