Subject: [kitten] Rcache avoidance

From: Nico Williams <[email-masked]>
Date: Sat, 13 Aug 2011 22:04:59 -0500

The design for GSS consists of:

 - a new GSS req_flag named, say, GSS_C_IMPLICIT_CONFIRMATION or
GSS_C_RCACHE_AVOIDANCE_OK;
 - update RFC2743 to indicate that GSS_Unwrap() and GSS_VerifyMIC()
MAY include the GSS_S_DUPLICATE_TOKEN supplementary major status code
when handling a PROT_READY token from the peer if the local end wants
to avoid using an rcache but depends on completing the security
context and/or consuming a non-PROT-READY per-msg token from the peer.

Additionally the Kerberos mechanism will be updated to state:

 - how to indicate rcache avoidance by the initiator (see separate
thread that I just started on the KRB-WG list);
 - that acceptors MAY use an rcache to handle PROT_READY tokens when
the initiator indicated that rcache avoidance is OK.

Question 1: do we want a req_flag by which the initiator could
indicate its intention to make use of the PROT_READY state if
available?  I think it'd be useful to have this.

Question 2: do we want a supplementary status code by which to
indicate that a per-message token was a PROT_READY token?

Nico
--