Subject: Re: Last Call: GSS Algorithm for TSIG (GSS-TSIG) to Proposed Standard

From: Lawrence Greenfield <[email-masked]>
Date: Thu, 21 Mar 2002 23:47:37 -0500

[ post by non-subscriber ]

[better late than never for the last call]

Section 9 on this draft addresses "Conformance".  I am confused by the
requirements of this section.  It starts by saying that "DNS clients
and servers SHOULD specify SPNEGO mech_type in their GSS API calls"
and then says "it is required that"

    - DNS servers specify SPNEGO mech_type
    - GSS APIs called by DNS client support Kerberos v5
    - GSS APIs called by DNS server support SPNEGO [RFC2478] and
      Kerberos v5.

Does the client need to use SPNEGO or merely Kerberos v5?  Does the
client need to use Kerberos v5 under SPNEGO?  What do I need to
implement to actually interoperate?  (I think the text is trying to
tell me but I just can't tell.)

Also, the OID for the Kerberos v5 GSS mechanism was mistated in some
documents; several members of the kerberos wg seemed to be fuzzy on
what was correct when I asked them; it would probably be worthwhile to
state explicitly what is meant by the Kerberos v5 GSS mechanism.

thanks,
Larry

--
to unsubscribe send a message to [email-masked] with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://ops.ietf.org/lists/namedroppers/>

---

From: "Levon Esibov" <[email-masked]>
Date: Mon, 25 Mar 2002 17:15:43 -0800

> tell me but I just can't tell.)

You've got it right: client can use Kerberos v5 or SPNEGO (as long as
Kerberos v5 is supported on the client and SPNEGO can choose it as
underlying security mechanism).

> state explicitly what is meant by the Kerberos v5 GSS mechanism.

This draft points to the RFC 1964 as the authoritative document
specifying "Kerberos Version 5 GSS-API Mechanism" and OID specified in
RFC 1964 must be used.

Thanks,
Levon.