[3953] in Kerberos-V5-bugs
daemon@ATHENA.MIT.EDU (Sam Hartman via RT)
Fri Feb 21 15:45:59 2003
Date: Fri, 21 Feb 2003 15:44:57 -0500 (EST)
Mail-Followup-To: rt@krbdev.mit.edu
Message-Id: <rt-1352-4614.6.23034355677149@krbdev.mit.edu>
In-Reply-To: <rt-1352@krbdev.mit.edu>
From: "Sam Hartman via RT" <rt-comment@krbdev.mit.edu>
Mail-Copies-To: never
To: wyllys.ingersoll@sun.com
cc: krb5-prs@mit.edu
Reply-To: rt-comment@krbdev.mit.edu
Errors-To: krb5-bugs-bounces@mit.edu
O, I completely agree that the MIT code is broken with regard to
prot_ready. My question is whether there is a reasonable way to make
prot_ready work for an RFC 1964 mechanism? Reading the base GSSAPI
spec, it sounds like both pwrap and unwrap must work. I.E. in the
Kerberos case, a client must be able to receive both a context token
and a message token from the acceptor, and pass the message token into
gss_unwrap before passing the context token into
gss_accept_sec_context.
I don't know how to handle sequence state in that case. Clearly we
cannot make sequence service available until the context is
established, but I don't even know how to resynchronize state dealing
with messages that may have already been received in order to set that
up.
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
http://mailman.mit.edu/mailman/listinfo/krb5-bugs
