[18929] in Kerberos_V5_Development
Re: [PATCH] Fix SPNEGO interoperability with servers implementing
daemon@ATHENA.MIT.EDU (Nico Williams)
Mon Aug 4 14:55:36 2014
Date: Mon, 4 Aug 2014 13:55:26 -0500
From: Nico Williams <nico@cryptonector.com>
To: David Woodhouse <dwmw2@infradead.org>
Message-ID: <20140804185525.GU3579@localhost>
MIME-Version: 1.0
Content-Disposition: inline
In-Reply-To: <1407176946.28796.9.camel@infradead.org>
Cc: krbdev@mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krbdev-bounces@mit.edu
On Mon, Aug 04, 2014 at 07:29:06PM +0100, David Woodhouse wrote:
> > I was hoping to find
> > support for this hypothesis in the history of the RFC 4178 drafts, but
> > even the -00 version of the draft contains all of the elements we're
> > talking about (the presence of the request-mic flag, the verbiage on how
> > to react to it, and the flat requirement of exchanging MICs). So this
> > is complete speculation.
>
> Are any of the authors still available to ask? If their implementation
> in Windows isn't considered to be sufficient evidence of their intent,
> that is...
The mailing list archives should have plenty of content. IIRC SPNEGO
was ambiguous as specified and subject to a downgrade attack as
implemented by one major implementor. We thought we'd not be able to
fix this without a flag day untill Larry Zhu came up with a fix that
worked for all the cases we cared about, and this led to RFC4178.
I was an active participant, though I don't recall the details but I
could swap it all back in if need be. All authors and participants
should still be reachable, but you're likely to find the mail archives
degrade less badly than human memory does!
Nico
--
_______________________________________________
krbdev mailing list krbdev@mit.edu
https://mailman.mit.edu/mailman/listinfo/krbdev
