Re: AD Review: draft-ietf-kink-kink [starting at section 5]

issue #13 Replay protection (section 5)

At Fri, 28 Jan 2005 21:19:39 -0500 (EST),
Sam Hartman <[email protected]> wrote:
> 
> [**] The document claims that the transaction id is not used for
> replay detection because Kerberos provides that.  How is that true?
> The authenticator is protected against replays but how is the rest of
> the message bound to that specific authenticator instead of to a
> session key of a ticket?

The KINK checksum do it.  It is calculated from the whole message
including the authenticator, so replaying a part of a old message
with a newly captured authenticator will not succeed.

Am I missing your point?

-- 
KAMADA Ken'ichi <[email protected]>