[2880] in Kerberos
variable message lifetime idea
daemon@ATHENA.MIT.EDU (Clifford Neuman)
Fri Oct 29 11:51:50 1993
Date: Fri, 29 Oct 1993 08:28:53 -0700
From: Clifford Neuman <bcn@ISI.EDU>
To: Jim_Miller@suite.com
Cc: kerberos@MIT.EDU
In-Reply-To: Jim Miller's message of Thu, 28 Oct 93 19:29:02 -0500 <9310290042.AA11449@bilbo.suite.com>
The value for the maximum clock skew must be determined by the party
that is verifying the authentication. It should not be in the ticket.
One might want to support a call on the server side that sets the
value of the clock skew to some value different than that hardcoded in
the sources.
Note, however, that the rule is that within the period of the maximum
clock skew, the verifier must keep track of all authenticators it has
seen. Thus, by increasing the maximum clock skew, you also increase
the amount of state that must be maintained by the server.
Finally, one can not just increase the clock skew in large steps. If
you have been running with a particular clock skew, and you decide you
want to increase it, you can only do so at a rate of one second per
second. That is, you need to be sure that you have kept track of all
authenticators that have been seen since the earliest timestamp you
will accept.
~ Cliff
