[2445] in Kerberos
Re: Porting problems in V5
daemon@ATHENA.MIT.EDU (Steve Lunt)
Wed Dec 9 15:23:59 1992
Date: Wed, 9 Dec 92 14:59:25 EST
From: Steve Lunt <lunt@ctt.bellcore.com>
To: Tony.Lill@waterloo.ncr.com
Cc: kerberos@Athena.MIT.EDU
> My current solution(hack) is to adjust the value on the DOS machine so
> it's based on the UNIX epoch. A better solution would be to encode the
> timestamp in "Universal" time, as the rest of the timestamps are, or
> at least, put a tm-like structure instead of the long. Comments?
Use Universal Time. Is this part of the Kerberos V5 RFC?
> The second problem is more serious. In the ticket requests and
> responses is the nonce field. From what I could gather, this is used
> for two purposes, as a unique identifier, and as as a base to check if
> the starttime in the reply is within the allowed clock skew.
In reading the RFC, the purpose of the nonce is simply to act as a
unique, one-time, never-use-again number. The RFC suggests using a
random number or a timestamp (monotonically increasing to ensure it
is never used twice). Thus, it's a mistake to interpret the nonce as
a representation of the client's time.
-- Steve
