[330] in Kerberos
ticket/authenticator terminology
daemon@TELECOM.MIT.EDU (Jerome H. Saltzer)
Wed Mar 9 13:49:22 1988
To: kerberos@ATHENA.MIT.EDU, spm@ATHENA.MIT.EDU, bcn@ATHENA.MIT.EDU
From: Jerome H. Saltzer <Saltzer@ATHENA.MIT.EDU>
Bill Bryant just pointed out that there is a terminology problem in
the documents describing Kerberos, in which there are three kinds of
physical objects being discussed but only two labels for them; the
documentation and the code are inconsistent in the way they apply the
labels. This inquiry is to see if there are strong opinions one way
or another as to which way we should resolve the inconsistency.
The three physical objects are:
Thing #1. The thing that Kerberos sends to a client, almost
always called a "ticket".
Thing #2. The thing that a client adds to a ticket to
inhibit replay, called an "authenticator" in the Technical Plan,
not specifically labeled in the code and accompanying comments.
Thing #3. The thing that a client sends to a server, consisting
of a Thing #1 and a Thing #2. Thing #3 is variously called a
"ticket" (in the Technical Plan) and an "authenticator" (in the
code and some manual pages.)
On the one hand. . .
The Technical Plan pattern of using the term "ticket" to describe
both Thing #1 and Thing #3 supports the common usage "you have to
present a ticket to the server to prove your identity." Describing
the extra field created by the client as an "authenticator" is
consistent with usual terminology in the cryptographic/authentication
field. It is also consistent with first-cut, simplified descriptions
of Kerberos that omit mention of the replay-prevention machinery, in
which case there are only "tickets" to discuss.
On the other hand. . .
The pattern of labeling Thing #3 the "authenticator" seems to be
fairly deeply embedded in variable names, comments in the code, and
some manual pages.
I'm inclined to suggest for new documentation the usage in the
Technical Plan, and to change the manual pages to conform. Does
anyone else have an opinion?
Jerry
