Subject: AD review of draft-ietf-kitten-gssapi-prf-07

From: Sam Hartman <[email-masked]>
Date: Mon, 14 Nov 2005 18:22:49 -0500 (EST)

The The following are AD review comments for the GSSAPI PRF draft.  I may end up issuing a last call while these comments are still under discussion.

1) Update the reference to RFC 1750 to the document that obseletes it.

2) Part of the document implies that the output should be as long as
   requested by the requester; part says that it may be shorter.  Which is it?

     If the implementation cannot produce the desired output due to lack
     of resources then it MUST return GSS_S_FAILURE and MUST set a
     suitable minor status code.

     Mechanisms MAY limit the output of the PRF, possibly in ways related
     to the types of cryptographic keys available for the PRF function,
     thus the prf_out output of GSS_Pseudo_random() MAY be smaller than

I think you need to give enough advice to tell applications whether
they should expect to need counters and other extension mechanisms if
they call the PRF for reasonably short outputs like the sizes of
common crypto keys.  I hope the answer is no.

_______________________________________________
Kitten mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/kitten