Subject: Ticket extensions

From: Ken Hornstein <[email-masked]>
Date: Mon, 10 May 1999 17:31:54 -0400

Well, since John wanted to get the ball rolling ...

This has been bugging me since the last IETF, and I figure I'd better
say something now.  The issue of ticket extensions breaking existing
versions of Kerberos 5 troubles me.  I'm not sure it's been answered
completely if adding arbitrary ASN.1 sequences will break existing
Kerberos implementation, but I seem to recall that people thought
ticket extensions would break current implementations (please
correct me if I'm wrong).

I believe that issuing a Kerberos-revisions RFC that specifies a
protocol that breaks currently-deployed implementations would be extremely
bad.  We are just now getting to the point where Kerberos 5 is appearing
in a number of vendor products; creating a new protocol specification
that is incompatible with these deployed versions would be extrememly
harmful in my eyes.  Yes, we really do want all of these vendors to
upgrade their supported versions of Kerberos, not the least reason being
things like 3DES support.  But we still have tons of people running
Kerberos 4!  At least for them a completely new protocol was invented.
I think that the issue of providing compatibility with older clients needs
to be explored more thoroughly.

If I'm off-base here or this was already discussed at Minneapolis, then
I apologize; I was recovering from a bad case of the flu during the CAT
WG meeting and it's entirely possible I missed something.

--Ken
==========================================================================
This message was posted through the Stanford campus mailing list
server.  If you wish to unsubscribe from this mailing list, send the
message body of "unsubscribe ietf-cat-wg" to [email-masked]