[33715] in Kerberos
Re: (mk|rd)_(priv|safe) and NAT
daemon@ATHENA.MIT.EDU (Greg Hudson)
Wed Aug 3 18:13:16 2011
From: Greg Hudson <ghudson@mit.edu>
To: Chris Hecker <checker@d6.com>
In-Reply-To: <4E39C204.2030902@d6.com>
Date: Wed, 03 Aug 2011 18:13:11 -0400
Message-ID: <1312409591.23877.301.camel@t410>
Mime-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Wed, 2011-08-03 at 17:47 -0400, Chris Hecker wrote:
> Right, but I'm going to force the replay cache off and use subkeys like
> we discussed in the other thread. I assume I can't use the do-sequence
> flag on an unordered/unreliable channel? So, if I want to mk_priv/safe
> on that channel, will I need another auth_context?
Yes, you will need separate auth contexts if you want to use sequence
numbers on some messages but not others.
For the unordered messages, since you are using neither sequence numbers
nor a replay cache, you'll need to address replays at the application
protocol layer.
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
