[35750] in Kerberos
Re: Clock skew too great status code
daemon@ATHENA.MIT.EDU (Nico Williams)
Wed Feb 5 14:48:35 2014
MIME-Version: 1.0
In-Reply-To: <52F26F59.6070600@mit.edu>
Date: Wed, 5 Feb 2014 13:47:10 -0600
Message-ID: <CAK3OfOgCDKX3XyZ91oSsHbAj4+EWra7pkCzjSt4n+mrO-8WkHw@mail.gmail.com>
From: Nico Williams <nico@cryptonector.com>
To: Greg Hudson <ghudson@mit.edu>
Cc: kerberos <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Wed, Feb 5, 2014 at 11:05 AM, Greg Hudson <ghudson@mit.edu> wrote:
> This could all work better if krb5 had used a ticket lifetime instead of
> an end time (like krb4 did, but without the crazy 8-bit representation
> of the lifetime). But the protocol was designed under the assumption
> that clients, servers, and KDCs would all have mostly synchronized
> clocks, so it went with the simplification of always using absolute
> timestamps and never relative intervals.
And yet implementation-wise relative times are still needed... I
agree, 'twould have been better to have relative lifetime.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
