Kerberos error code 82 conflict in draft-ietf-krb-wg-pkinit-alg-agility-06

For discussion tomorrow:

While I was going through my database of Kerberos number assignments
in preparation for handing off numbers to IANA, I found that there is
a conflict for error code 82.  draft-ietf-krb-wg-pkinit-alg-agility-06
has KDC_ERR_NO_ACCEPTABLE_KDF=82, while the published RFC 6111 has
KRB_AP_ERR_PRINCIPAL_UNKNOWN=82.

I'm not sure how this happened.  I tried to find e-mail relevant to
this assignment but could not.  (I haven't done a really extensive
search though.)  Unfortunately, I also see

error_code KRB5KDC_ERR_NO_ACCEPTABLE_KDF, "No acceptable KDF offered"

in the MIT krb5 code, which we seem to have some released code
referencing.  RFC 6111 seems to have priority, though:

2007-03-03 draft-ietf-krb-wg-naming-03
vs
2007-07-09 draft-ietf-krb-wg-pkinit-alg-agility-03

were the earliest versions of each that I could find.

What should we do about this?  Has anyone implemented anything that
uses KRB_AP_ERR_PRINCIPAL_UNKNOWN=82?

Sam has suggested that we overload the error code, because there
shouldn't be a situation where an unknown well-known principal name is
used in conjunction with PKINIT algorithm agility.  I think it's still
possible, but unlikely.
_______________________________________________
ietf-krb-wg mailing list
[email protected]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg