Subject: kerberos 5 GSS-API mechanism GetMIC() tokens

From: "J. Bruce Fields" <[email-masked]>
Date: Tue, 30 Apr 2002 15:27:18 -0400

As I was working on our (university of michigan/citi's) linux nfsv4
implementation, I noticed that the tokens implemented by our Kerberos GSS-API
mechanism's GSS_GetMIC() are always prepended by a mechanism OID.  This does
not agree with the format of GSS_GetMIC tokens as described in section 1.2.1 of
RFC 1964 (the Kerberos/GSS-API RFC).  Note that prepending the mechanism type
in this way is unnecessary, since GSS_GetMIC() and GSS_VerifyMIC() are passed
context handles which already specify the mechanism.  Also, the GSS-API RFC
does not require the mechanism type on tokens other than context initialization
tokens (see RFC2078, section 3.1, or RFC 1508, appendix B).

However, since we've succesfully interoperated with other implementations,
everyone is probably making the same mistake.

So is RFC 1964 wrong, or are our implementations or wrong, or is it just me?

Thanks in advance for any enlightenment.

--Bruce Fields