Re: CAMMAC extensibility options

On Wed, Feb 15, 2012 at 12:14 PM,  <[email protected]> wrote:
> With the pubkey-signature field removed, AD-CAMMAC looks like:
>
>    AD-CAMMAC                   ::= SEQUENCE {
>          kdc-signature         [0] Checksum,
>          svc-signature         [1] Checksum,
>          trusted-svc-signature [2] OPT-Checksum OPTIONAL,
>          elements              [3] AuthorizationData
>    }
>
> In the interim meeting, we determined that we want to be able to add
> new verifiers somehow.  Here are the basic options I can see:
>
> 1. Put a ", ..." at the end of that sequence.  Then we can add new
> fields through standards action, one at a time.
>
> Aesthetically, it's a little weird to have some verifiers before the
> elements and some after, so maybe we'd move the elements to the front.

You could have two extensibility markers, but yes, I'd rather not use
extensibility markers for this.

> 2. Tom raised the preference that we have verifiers (including ones
> added later) before elements, so that one could compute the checksums
> over the elements in one pass over the DER encoding.  I can't really
> conceive of a scenario where someone would want streamy processing of
> authorization data, but if this is a requirement, we would need
> something like:
>
>    AD-CAMMAC                   ::= SEQUENCE {
>          verifiers             [0] CAMMACVerifiers,
>          elements              [1] AuthorizationData
>    }
>
>    CAMMACVerifiers             ::= SEQUENCE {
>          kdc-signature         [0] Checksum,
>          svc-signature         [1] Checksum,
>          trusted-svc-signature [2] OPT-Checksum OPTIONAL,
>          ...
>    }

I prefer this, (2).

Someone said something about needing to have a kvno field, right?

Nico
--
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg