Subject: Re: Last word on MechListMIC encoding

From: "Frank Balluffi" <[email-masked]>
Date: Thu, 2 Dec 2004 18:00:47 -0500

Wyllys,

Because draft-ietf-kitten-2478bis-02.txt says EXPLICIT:

      SPNEGOASNOneSpec {
          iso(1) identified-organization(3) dod(6) internet(1)
          security(5) mechanism(5) snego (2) modules(4) spec2(2)
      } DEFINITIONS EXPLICIT TAGS ::= BEGIN

      -- rest of definitions here

      END

I would expect a mechTypes element in a NegTokenInit to be prefixed with A0 nn -- mechTypes is EXPLICITly tagged with 0:

       NegTokenInit ::= SEQUENCE {
           mechTypes       [0] MechTypeList,
           reqFlags        [1] ContextFlags  OPTIONAL,
           mechToken       [2] OCTET STRING  OPTIONAL,
           mechListMIC     [3] OCTET STRING  OPTIONAL,
           ...
       }

Frank

                      Wyllys Ingersoll                                                                                                  
                      <wyllys.ingersoll@        To:       [email-masked]                                                               
                      sun.com>                  cc:                                                                                     
                      Sent by:                  Subject:  Last word on MechListMIC encoding                                             
                      kitten-bounces@lis                                                                                                
                      ts.ietf.org                                                                                                       

                      12/02/2004 09:50                                                                                                  
                      AM                                                                                                                

The latest draft  submitted (-02) specifically states how the
MechListMIC is to be encoded:
Section 5, item 'a' says:
        [...] only the DER encoding of the type MechTypeList is included.

I interpret this to mean the following in the case where the
MechList contains the Kerberos OID (as an example):
       30 nn 06 09 2A 86 48 86 F7 12 01 02 02 ...

This is acceptable to me (even though it breaks our current
implementation, which I seriously doubt that anyone is
interoperating with anyway since its not yet released).

Is everyone else in agreement about the definition of how
to encode the MIC  and with the text as it is written?

-Wyllys Ingersoll

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

--

This e-mail may contain confidential and/or privileged information. If you are not the intended recipient (or have received this e-mail in error) please notify the sender immediately and destroy this e-mail. Any unauthorized copying, disclosure or distribution of the material in this e-mail is strictly forbidden.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten

---

From: Sam Hartman <[email-masked]>
Date: Thu, 02 Dec 2004 22:33:45 -0500

>>>>> "Frank" == Frank Balluffi <[email-masked]> writes:

    Frank> Wyllys,

    Frank> Because draft-ietf-kitten-2478bis-02.txt says EXPLICIT:

    Frank>       SPNEGOASNOneSpec { iso(1) identified-organization(3)
    Frank> dod(6) internet(1) security(5) mechanism(5) snego (2)
    Frank> modules(4) spec2(2) } DEFINITIONS EXPLICIT TAGS ::= BEGIN

    Frank>       -- rest of definitions here

    Frank>       END

    Frank> I would expect a mechTypes element in a NegTokenInit to be
    Frank> prefixed with A0 nn -- mechTypes is EXPLICITly tagged with
    Frank> 0:

Note that we are talking about the MIC, not the field in the sequence.
Do you believe based on section 5 that your comment applies to the
MIC?

--Sam