Re: AD Review: draft-ietf-kink-kink [starting at section 5]

>>>>> "KAMADA" == KAMADA Ken'ichi <[email protected]> writes:

    KAMADA> issue #13 Replay protection (section 5)

    KAMADA> At Fri, 28 Jan 2005 21:19:39 -0500 (EST),
    KAMADA> Sam Hartman <[email protected]> wrote:
    >>  [**] The document claims that the transaction id is not used
    >> for replay detection because Kerberos provides that.  How is
    >> that true?  The authenticator is protected against replays but
    >> how is the rest of the message bound to that specific
    >> authenticator instead of to a session key of a ticket?

    KAMADA> The KINK checksum do it.  It is calculated from the whole
    KAMADA> message including the authenticator, so replaying a part
    KAMADA> of a old message with a newly captured authenticator will
    KAMADA> not succeed.

Thanks, this issue can be closed.