Subject: Re: [Ietf-krb-wg] Late Last Call comments: draft-ietf-krb-wg-anonymous

From: Sam Hartman <[email-masked]>
Date: Tue, 08 Jul 2008 10:20:48 -0400

>>>>> "Larry" == Larry Zhu <[email-masked]> writes:

    >> First, if I call gss_display_name on an anonymous principal in
    >> an acceptor, what do I expect to get back?

    Larry> Would section 2.1.1 of RFC1964 be sufficient for this
    Larry> purpose?

not really.  As Ken pointed out, there is a significant mess

surrounding GSS-API and anonymous names.See section 4.5 in RFC 2743.
In particular, two anonymous names need to compare as false; a special
name type is used; etc.  The GSS-API semantics do not seem to match
well onto some of the Kerberos semantics you propose.

Martin Rex said that the anonymous support was relatively immature in
GSS-API and that perhaps it needed to be revisited.  I tend to agree.

The other concern I have is the multiple ways to specify anonymous
names for the AS case.  I don't understand why we need multiple ways
to do that.

--Sam

_______________________________________________
Ietf mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/ietf

---

From: Larry Zhu <[email-masked]>
Date: Sun, 27 Jul 2008 08:00:06 -0700

Sam and I got together today and discussed this issue. we believe by adding the following text then we have the right trade-off.

  If anonymous PKINIT is used, the returned realm name MUST be the anonymous realm.

All the issues in this thread are assumed to have been addressed with this proposed change. This is pending workgr
--larry
-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Tuesday, July 08, 2008 7:21 AM
To: Larry Zhu
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-krb-wg] Late Last Call comments: draft-ietf-krb-wg-anonymous

--Sam

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Larry Zhu <[email-masked]>
Date: Sun, 27 Jul 2008 08:03:02 -0700

The last sentence in the previous email was not completed before the send button was hit inadvertently. It should read "This is pending krb-wg working group validation.".

--larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Sam Hartman
Sent: Tuesday, July 08, 2008 7:21 AM
To: Larry Zhu
Cc: [email-masked]; [email-masked]
Subject: Re: [Ietf-krb-wg] Late Last Call comments: draft-ietf-krb-wg-anonymous

--Sam